CVE-2026-2950 Details
Description
Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.
A prototype pollution vulnerability has been identified in Lodash versions 4.0.0 prior to 4.17.23, specifically within the _.unset and _.omit functions. This vulnerability allows an attacker to manipulate paths in a way that causes Lodash to delete properties from global prototypes, such as Object.prototype, Number.prototype, and String.prototype. While the vulnerability enables the removal of prototype properties, it does not allow for overwriting their original functionality.
Users are advised to upgrade to Lodash version 4.17.23 or later. Instructions for upgrading can be found in the Lodash GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg | openjs | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | openjs |
Affected Products
| Product | Versions |
|---|---|
| lodash lodash | >= 4.0.0, < 4.17.23 |
CPE
Remediation
| |
| lodash lodash-amd | >= 4.0.0, < 4.17.23 |
CPE
Remediation
| |
| lodash lodash-es | >= 4.0.0, < 4.17.23 |
CPE
Remediation
| |
| lodash lodash.unset | >= 4.0.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 7, 2026 | Initial Analysis | [email protected] |
| Mar 31, 2026 | New CVE Received | openjs |