Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2026-2950

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
31/03/2026
Last modified:
07/04/2026

Description

Impact:<br /> <br /> Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.<br /> <br /> The issue permits deletion of prototype properties but does not allow overwriting their original behavior.<br /> <br /> Patches:<br /> <br /> This issue is patched in 4.18.0.<br /> <br /> Workarounds:<br /> <br /> None. Upgrade to the patched version.

Impact

Vector 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS v3.1 Severity and Metrics:

Base Score: 6.50 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): Low
Availability (A): Low

Base Score 3.x
6.50
Severity 3.x
MEDIUM

Vulnerable products and versions

CPE From Up to
cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* 4.0.0 (including) 4.17.23 (excluding)
cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:* 4.0.0 (including) 4.17.23 (excluding)
cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:* 4.0.0 (including) 4.17.23 (excluding)
cpe:2.3:a:lodash:lodash.unset:*:*:*:*:*:node.js:*:* 4.0.0 (including)

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools