CVE-2026-2950
Gravedad CVSS v3.1:
MEDIA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
31/03/2026
Última modificación:
01/04/2026
Descripción
*** Pendiente de traducción *** Impact:<br />
<br />
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.<br />
<br />
The issue permits deletion of prototype properties but does not allow overwriting their original behavior.<br />
<br />
Patches:<br />
<br />
This issue is patched in 4.18.0.<br />
<br />
Workarounds:<br />
<br />
None. Upgrade to the patched version.
Impacto
Puntuación base 3.x
6.50
Gravedad 3.x
MEDIA