Prototype Pollution Vulnerability in Lodash by Lodash

CVE-2026-2950

What is CVE-2026-2950?

Lodash versions up to 4.17.23 are susceptible to a prototype pollution vulnerability in the _.unset and _.omit functions. An attacker can exploit this flaw by utilizing array-wrapped path segments, allowing for the deletion of properties from JavaScript's built-in prototypes like Object.prototype, Number.prototype, and String.prototype. While the vulnerability facilitates the removal of prototype properties, it does not permit modification of their original functionality. Users are urged to upgrade to Lodash version 4.18.0 or later to mitigate the issue, as no workarounds are available. For more details, refer to the security advisory.

References