- Description
- Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.
- Source
- ce714d77-add3-4f53-aff5-83d477b104bb
- NVD status
- Analyzed
- Products
- lodash, lodash-amd, lodash-es, lodash.unset
CVSS 3.1
- Type
- Primary
- Base score
- 5.3
- Impact score
- 1.4
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity
- MEDIUM
- ce714d77-add3-4f53-aff5-83d477b104bb
- CWE-1321
- Hype score
- Not currently trending
🚨*CVE* CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://t.co/I2P3GU38NL… https://t.co/ASDj5M1WxX ----- Traducción: Impacto de CV… https://t.co/utmtNg
@infoflowcloud
1 Apr 2026
184 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://t.co/Sr53IytKMp… https://t.co/wilANcmmSh
@CVEnew
1 Apr 2026
253 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "0F9E287B-784B-472D-9FA2-1469E4C8A810",
"versionEndExcluding": "4.17.23",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "3A1B5527-B25F-49B8-A289-E964EFFCF4E4",
"versionEndExcluding": "4.17.23",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "4C20325C-6B92-4775-89D7-2650F158B622",
"versionEndExcluding": "4.17.23",
"versionStartIncluding": "4.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:lodash:lodash.unset:*:*:*:*:*:node.js:*:*",
"matchCriteriaId": "43DC850D-9F26-4445-BAB1-9AF9BA37095C",
"versionStartIncluding": "4.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]