CVE-2026-2950lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Updated under an hour ago ()
Does this affect you?
It affects lodash and 6 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
- CVSS
- 6.5 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Weakness (CWE)
- CWE-1321
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- openjs
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
lodash lodash lodash:lodash (from the name) | from 4.17.23 before 4.18.1; 4.18.1 not affected | CNA record |
lodash lodash-es lodash:es (from the name) | from 4.17.23 before 4.18.1; 4.18.1 not affected | CNA record |
lodash lodash-amd lodash:amd (from the name) | from 4.17.23 before 4.18.1; 4.18.1 not affected | CNA record |
lodash lodash.unset lodash:lodash.unset (from the name) | before 4.18.0; 4.18.0 not affected | CNA record |
lodash lodash.omit lodash:lodash.omit (from the name) | before 4.18.0; 4.18.0 not affected | CNA record |
lodash lodash lodash:lodash | from 4.0.0 before 4.17.23 | NVD |
lodash lodash-amd lodash:lodash-amd | from 4.0.0 before 4.17.23 | NVD |
lodash lodash-es lodash:lodash-es | from 4.0.0 before 4.17.23 | NVD |
lodash lodash.unset lodash:lodash.unset | from 4.0.0 | NVD |
References
- https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
- https://cna.openjsf.org/security-advisories.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.