CVE-2026-2950 Details
Description
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
A prototype pollution vulnerability has been identified in Lodash versions 4.0.0 prior to 4.17.23, specifically within the _.unset and _.omit functions. This vulnerability allows an attacker to manipulate paths in a way that causes Lodash to delete properties from global prototypes, such as Object.prototype, Number.prototype, and String.prototype. While the vulnerability enables the removal of prototype properties, it does not allow for overwriting their original functionality.
Users are advised to upgrade to Lodash version 4.17.23 or later. Instructions for upgrading can be found in the Lodash GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | |
| https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh | openjs |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | openjs |
Affected Products
| Product | Versions |
|---|---|
| lodash lodash | >= 4.0.0, < 4.17.23 |
CPE
Remediation
| |
| lodash lodash-amd | >= 4.0.0, < 4.17.23 |
CPE
Remediation
| |
| lodash lodash-es | >= 4.0.0, < 4.17.23 |
CPE
Remediation
| |
| lodash lodash.unset | >= 4.0.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | openjs |
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | openjs |