Live › vulnerability › CVE-2026-2950
Lodash's _.unset, _.omit and _.pullAt can be tricked by array-wrapped path segments into deleting properties from Object.prototype, Number.prototype and String.prototype. The sources say this removes prototype properties but does not overwrite their original behavior.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:39 UTC, 0h before NVD. All times on this page are UTC.
Projects that depend on lodash, lodash-es or lodash-amd at 4.17.23 or earlier, or on the standalone lodash.unset or lodash.omit packages below 4.18.0. Exposure is greatest where user-supplied input reaches the path argument of _.unset, _.omit or _.pullAt. Projects that do not pass external input to these functions have a lower risk, but the sources say there is no workaround other than upgrading.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| lodash | npm | = 4.17.23 | 4.18.1 |
| lodash-es | npm | = 4.17.23 | 4.18.1 |
| lodash-amd | npm | = 4.17.23 | 4.18.1 |
| lodash.unset | npm | < 4.18.0 | 4.18.0 |
| lodash.omit | npm | < 4.18.0 | 4.18.0 |
| lodash | vendor | >= 4.0.0, < 4.17.23 | 4.17.23 |
| lodash lodash-amd | vendor | >= 4.0.0, < 4.17.23 | 4.17.23 |
| lodash lodash-es | vendor |
| >= 4.0.0, < 4.17.23 |
| 4.17.23 |
| lodash lodash.unset | vendor | >= 4.0.0 | – |
npm ls lodash lodash-es lodash-amd lodash.unset lodash.omit to list installed versionslodash, lodash-es or lodash-amd below 4.18.1, and lodash.unset or lodash.omit below 4.18.0_.unset, _.omit or _.pullAt4.18.14.18.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The _.unset, _.omit, and _.pullAt functions are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.
The issue permits deletion of prototype properties but does not allow overwriting their original behavior.
The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
None. Upgrade to the patched version.
This page as .md · .json · in your agent: get_signal("CVE-2026-2950")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.