---
id: "CVE-2026-2950"
kind: "vulnerability"
aliases: ["CVE-2026-2950", "GHSA-f23m-r3pf-42rh"]
title: "lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt"
severity: "medium"
cvss: 6.5
epss: 0.00337
exploited: false
status: "open"
category: "package"
products: [{"name": "lodash", "fixed": ["4.18.1"], "affected": "= 4.17.23", "ecosystem": "npm"}, {"name": "lodash-es", "fixed": ["4.18.1"], "affected": "= 4.17.23", "ecosystem": "npm"}, {"name": "lodash-amd", "fixed": ["4.18.1"], "affected": "= 4.17.23", "ecosystem": "npm"}, {"name": "lodash.unset", "fixed": ["4.18.0"], "affected": "< 4.18.0", "ecosystem": "npm"}, {"name": "lodash.omit", "fixed": ["4.18.0"], "affected": "< 4.18.0", "ecosystem": "npm"}, {"name": "lodash", "fixed": ["4.17.23"], "affected": ">= 4.0.0, < 4.17.23", "ecosystem": "vendor"}, {"name": "lodash lodash-amd", "fixed": ["4.17.23"], "affected": ">= 4.0.0, < 4.17.23", "ecosystem": "vendor"}, {"name": "lodash lodash-es", "fixed": ["4.17.23"], "affected": ">= 4.0.0, < 4.17.23", "ecosystem": "vendor"}, {"name": "lodash lodash.unset", "fixed": [], "affected": ">= 4.0.0", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-1321", "lodash", "node", "npm", "package", "web-backend"]
not_affected_if: ["already-on-patched-version", "no-user-controlled-paths"]
published_at: "2026-03-31T20:16:26+00:00"
first_seen_at: "2026-11-03T15:39:39+00:00"
updated_at: "2026-11-03T15:51:35+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-f23m-r3pf-42rh", "first_seen_at": "2026-11-03T15:39:39+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2950", "first_seen_at": "2026-11-03T15:51:35+00:00"}]
---

# lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt

Lodash's _.unset, _.omit and _.pullAt can be tricked by array-wrapped path segments into deleting properties from Object.prototype, Number.prototype and String.prototype. The sources say this removes prototype properties but does not overwrite their original behavior.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:lodash affected = 4.17.23 fixed 4.18.1
- npm:lodash-es affected = 4.17.23 fixed 4.18.1
- npm:lodash-amd affected = 4.17.23 fixed 4.18.1
- npm:lodash.unset affected < 4.18.0 fixed 4.18.0
- npm:lodash.omit affected < 4.18.0 fixed 4.18.0
- vendor:lodash affected >= 4.0.0, < 4.17.23 fixed 4.17.23
- vendor:lodash lodash-amd affected >= 4.0.0, < 4.17.23 fixed 4.17.23
- vendor:lodash lodash-es affected >= 4.0.0, < 4.17.23 fixed 4.17.23
- vendor:lodash lodash.unset affected >= 4.0.0 fixed ?

## How to check

- Run `npm ls lodash lodash-es lodash-amd lodash.unset lodash.omit` to list installed versions
- Flag any `lodash`, `lodash-es` or `lodash-amd` below `4.18.1`, and `lodash.unset` or `lodash.omit` below `4.18.0`
- Check whether the app passes user-controlled paths into `_.unset`, `_.omit` or `_.pullAt`

## Fix

- lodash, lodash-es, lodash-amd: `4.18.1`
- lodash.unset, lodash.omit: `4.18.0`

## Timeline

- 2026-11-03T15:39:39+00:00 ghsa https://github.com/advisories/GHSA-f23m-r3pf-42rh
- 2026-11-03T15:51:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-2950

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/lodash/lodash/security-advisories/GHSA-f23m-r3pf-42rh
- [advisory] Maintainer's advisory: github.com https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
- [advisory] Maintainer's advisory: github.com https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
- [fix] Patch: github.com https://github.com/lodash/lodash/commit/4f0e376589e1889e8993e212a5c9041112ad178e
- [fix] Patch: github.com https://github.com/lodash/lodash/commit/87e6676934f7b4450fad68c35f0325ba165b48f8
- [fix] Patch: github.com https://github.com/lodash/lodash/commit/bbcf0036d27ef936f175bf26e73e247994d8e1e4
- [fix] Patch: github.com https://github.com/lodash/lodash/commit/db27b6bb14b12a1451b20edf87dfe307b87a337d
- [fix] Patch: github.com https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b
- [fix] Release: github.com https://github.com/lodash/lodash/releases/tag/4.18.1

## From the sources

### Impact

The `_.unset`, `_.omit`, and `_.pullAt` functions are vulnerable to prototype pollution. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

### Patches

The issue is patched from 4.18.0 to 4.18.1 depending on the package: `lodash`, `lodash-es`, and `lodash-amd` in 4.18.1, and the standalone `lodash.unset` and `lodash.omit` packages in 4.18.0.

### Workarounds

None. Upgrade to the patched version.

### References

- [CVE-2025-13465 / GHSA-xxjr-mmjv-4gpg](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) (original fix that this bypasses)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_