CVE-2026-2950
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
31/03/2026
Last modified:
01/04/2026
Description
Impact:<br />
<br />
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.<br />
<br />
The issue permits deletion of prototype properties but does not allow overwriting their original behavior.<br />
<br />
Patches:<br />
<br />
This issue is patched in 4.18.0.<br />
<br />
Workarounds:<br />
<br />
None. Upgrade to the patched version.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM