{"id":"CVE-2026-2950","kind":"vulnerability","aliases":["CVE-2026-2950","GHSA-f23m-r3pf-42rh"],"related":[],"title":"lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt","description":"### Impact\n\nThe `_.unset`, `_.omit`, and `_.pullAt` functions are vulnerable to prototype pollution. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\n### Patches\n\nThe issue is patched from 4.18.0 to 4.18.1 depending on the package: `lodash`, `lodash-es`, and `lodash-amd` in 4.18.1, and the standalone `lodash.unset` and `lodash.omit` packages in 4.18.0.\n\n### Workarounds\n\nNone. Upgrade to the patched version.\n\n### References\n\n- [CVE-2025-13465 / GHSA-xxjr-mmjv-4gpg](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) (original fix that this bypasses)","summary":"Lodash's _.unset, _.omit and _.pullAt can be tricked by array-wrapped path segments into deleting properties from Object.prototype, Number.prototype and String.prototype. The sources say this removes prototype properties but does not overwrite their original behavior.","severity":"medium","cvss":6.5,"epss":0.00337,"exploited":false,"exploited_at":null,"products":[{"name":"lodash","fixed":["4.18.1"],"affected":"= 4.17.23","ecosystem":"npm"},{"name":"lodash-es","fixed":["4.18.1"],"affected":"= 4.17.23","ecosystem":"npm"},{"name":"lodash-amd","fixed":["4.18.1"],"affected":"= 4.17.23","ecosystem":"npm"},{"name":"lodash.unset","fixed":["4.18.0"],"affected":"< 4.18.0","ecosystem":"npm"},{"name":"lodash.omit","fixed":["4.18.0"],"affected":"< 4.18.0","ecosystem":"npm"},{"name":"lodash","fixed":["4.17.23"],"affected":">= 4.0.0, < 4.17.23","ecosystem":"vendor"},{"name":"lodash lodash-amd","fixed":["4.17.23"],"affected":">= 4.0.0, < 4.17.23","ecosystem":"vendor"},{"name":"lodash lodash-es","fixed":["4.17.23"],"affected":">= 4.0.0, < 4.17.23","ecosystem":"vendor"},{"name":"lodash lodash.unset","fixed":[],"affected":">= 4.0.0","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-1321","lodash","node","npm","package","web-backend"],"not_affected_if":["already-on-patched-version","no-user-controlled-paths"],"how_to_check":"- Run `npm ls lodash lodash-es lodash-amd lodash.unset lodash.omit` to list installed versions\n- Flag any `lodash`, `lodash-es` or `lodash-amd` below `4.18.1`, and `lodash.unset` or `lodash.omit` below `4.18.0`\n- Check whether the app passes user-controlled paths into `_.unset`, `_.omit` or `_.pullAt`","fix":"- lodash, lodash-es, lodash-amd: `4.18.1`\n- lodash.unset, lodash.omit: `4.18.0`","status":"open","published_at":"2026-03-31T20:16:26+00:00","first_seen_at":"2026-11-03T15:39:39+00:00","triaged_at":"2026-11-03T15:41:23+00:00","updated_at":"2026-11-03T15:51:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T15:41:23Z","model":"claude-haiku-5-5","output":{"fix":"- lodash, lodash-es, lodash-amd: `4.18.1`\n- lodash.unset, lodash.omit: `4.18.0`","reach":"unknown","title":"lodash: array-wrapped paths let callers delete built-in prototype properties","impact":"medium","summary":"Lodash's _.unset, _.omit and _.pullAt can be tricked by array-wrapped path segments into deleting properties from Object.prototype, Number.prototype and String.prototype. The sources say this removes prototype properties but does not overwrite their original behavior.","audience":"developers","category":"package","nicknames":[],"who_cares":["npm","lodash","node","web-backend"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Built-in prototype properties can be deleted, breaking application behavior","analyst_note":"","how_to_check":"- Run `npm ls lodash lodash-es lodash-amd lodash.unset lodash.omit` to list installed versions\n- Flag any `lodash`, `lodash-es` or `lodash-amd` below `4.18.1`, and `lodash.unset` or `lodash.omit` below `4.18.0`\n- Check whether the app passes user-controlled paths into `_.unset`, `_.omit` or `_.pullAt`","plain_action":"","needs_analyst":false,"not_affected_if":["already-on-patched-version","no-user-controlled-paths"],"who_is_affected":"Projects that depend on lodash, lodash-es or lodash-amd at 4.17.23 or earlier, or on the standalone lodash.unset or lodash.omit packages below 4.18.0. Exposure is greatest where user-supplied input reaches the path argument of _.unset, _.omit or _.pullAt. Projects that do not pass external input to these functions have a lower risk, but the sources say there is no workaround other than upgrading.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00082,"input_tokens":4753,"output_tokens":689,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1321':48B '-13465':110C,207C '-2025':109C,206C '-2026':17A,25A '-2950':18A,26A '/lodash/lodash/security/advisories/ghsa-xxjr-mmjv-4gpg)':113C,215C '4.18.0':171C,196C '4.18.1':173C,187C '42rh':23A '4gpg':212C 'allow':135C,160C 'amd':33A,40A,185C 'array':8A,67B,130C 'array-path':7A 'array-wrap':66B,129C 'attack':122C 'backend':55B 'behavior':92B,164C 'built':141C 'built-in':140C 'bypass':10A,124C,220C 'check':126C 'cve':16A,24A,108C,205C 'cwe':47B 'delet':72B,136C,153C 'depend':174C 'es':30A,44A,181C 'f23m':21A 'fix':106C,217C 'function':99C 'ghsa':20A,209C 'ghsa-f23m-r3pf-42rh':19A 'ghsa-xxjr-mmjv-4gpg':208C 'github.com':112C,214C 'github.com/lodash/lodash/security/advisories/ghsa-xxjr-mmjv-4gpg)':111C,213C 'guard':115C 'impact':93C 'issu':151C,167C 'key':118C 'lodash':1A,27A,29A,32A,36A,37A,39A,41A,43A,45A,49B,56B,178C,180C,184C 'lodash-':179C 'lodash-amd':31A,38A,183C 'lodash-es':28A,42A 'lodash.omit':35A,193C 'lodash.unset':34A,46A,191C 'member':119C 'mmjv':211C 'node':50B 'none':198C 'npm':51B 'number.prototype':76B,147C 'object.prototype':75B,146C 'omit':13A,59B,96C 'origin':91B,163C,216C 'overwrit':89B,161C 'packag':52B,177C,194C 'pass':128C 'patch':165C,169C,202C 'path':9A,69B,132C 'permit':152C 'pollut':5A,104C 'properti':73B,85B,138C,156C 'prototyp':4A,84B,103C,143C,155C 'pullat':15A,61B,98C 'r3pf':22A 'refer':204C 'remov':83B 'say':81B 'segment':70B,133C 'sourc':80B 'standalon':190C 'string':117C 'string.prototype':78B,149C 'trick':64B 'unset':12A,58B,95C 'upgrad':199C 'version':203C 'via':6A 'vulner':2A,101C 'web':54B 'web-backend':53B 'workaround':197C 'wrap':68B,131C 'xxjr':210C","nicknames":[],"mitigations":[],"who_affected":"Projects that depend on lodash, lodash-es or lodash-amd at 4.17.23 or earlier, or on the standalone lodash.unset or lodash.omit packages below 4.18.0. Exposure is greatest where user-supplied input reaches the path argument of _.unset, _.omit or _.pullAt. Projects that do not pass external input to these functions have a lower risk, but the sources say there is no workaround other than upgrading.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["lodash","lodashamd","lodashes","lodashlodashamd","lodashlodashes","lodashlodashunset","lodashomit","lodashunset"],"ptokens":["amd","es","lodash","omit","unset"],"labels":["cwe1321","lodash","medium","node","npm","package","vendor","webbackend"],"first_public_at":"2026-03-31T19:03:29+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f23m-r3pf-42rh","url":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","severity":"medium","published_at":"2026-04-01T23:50:27+00:00","modified_at":"2026-11-03T15:37:13+00:00","first_seen_at":"2026-11-03T15:39:39+00:00","fetched_at":"2026-11-03T15:54:57+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-2950","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","severity":null,"published_at":"2026-03-31T20:16:26+00:00","modified_at":"2026-10-15T07:18:00+00:00","first_seen_at":"2026-11-03T15:51:35+00:00","fetched_at":"2026-11-03T15:51:35+00:00","note":null}],"documents":[{"id":58457,"url":"https://api.github.com/repos/lodash/lodash/security-advisories/GHSA-f23m-r3pf-42rh","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":58458,"url":"https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-03-31T19:03:29+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":58459,"url":"https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":58460,"url":"https://github.com/lodash/lodash/commit/4f0e376589e1889e8993e212a5c9041112ad178e","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58461,"url":"https://github.com/lodash/lodash/commit/87e6676934f7b4450fad68c35f0325ba165b48f8","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58462,"url":"https://github.com/lodash/lodash/commit/bbcf0036d27ef936f175bf26e73e247994d8e1e4","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58463,"url":"https://github.com/lodash/lodash/commit/db27b6bb14b12a1451b20edf87dfe307b87a337d","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58464,"url":"https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58465,"url":"https://github.com/lodash/lodash/releases/tag/4.18.1","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}