CoreCVE
Back

MEDIUM

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Published Mar 31, 2026

Description

Impact:

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

Patches:

This issue is patched in 4.18.0.

Workarounds:

None. Upgrade to the patched version.

Affected products

Remediation

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Metrics

Weaknesses (2)

CWE-1321

CWE-915

References (7)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner openjs
Published Mar 31, 2026
Updated Apr 1, 2026
Reserved Feb 21, 2026
Link CVE-2026-2950
CISA Vulnrichment
Updated Apr 1, 2026
NVD
Status Analyzed
Modified Jul 24, 2026
Link CVE-2026-2950
Red Hat
Severity Moderate
Public date Mar 31, 2026
Links CVE-2026-2950 - Bugzilla
GHSA-F23M-R3PF-42RH