ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-2950

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

Published Mar 31, 2026 · catalog updated Oct 17, 2026 · The _.unset and _.omit

Check if you run it

No confirmed exploitation is on record for CVE-2026-2950. EPSS is 0.40%. Act only if a listed version of The _.unset and _.omit is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (The _.unset and _.omit).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.40%
Remediation
Advisory link
Affected products
cpe lodash/lodash · cpe lodash/lodash-amd · cpe lodash/lodash-es · cpe lodash/lodash.unset · npm lodash · npm lodash-amd

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe lodash/lodashversion unspecified
  • cpe lodash/lodash-amdversion unspecified
  • cpe lodash/lodash-esversion unspecified
  • cpe lodash/lodash.unsetversion unspecified
  • npm lodash0 → 4.18.0
  • npm lodash-amd0 → 4.18.0
  • npm lodash-es0 → 4.18.0
  • npm lodash.unset4.0.0 → 4.18.0
  • vendor lodash lodashversion unspecified
  • vendor lodash lodash-amdversion unspecified
  • vendor lodash lodash-esversion unspecified
  • vendor lodash lodash.omitversion unspecified
  • vendor lodash lodash.unsetversion unspecified

How to fix CVE-2026-2950

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-2950. EPSS is 0.40%. Act only if a listed version of The _.unset and _.omit is installed.

Which versions are affected?

Compare what you have installed with 0 → 4.18.0, 4.0.0 → 4.18.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution). EPSS 0.40%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 31, 2026 · NIST NVD

    Detected

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype propertie

  2. Oct 15, 2026 · NIST NVD

    Updated

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype propertie

  3. Oct 17, 2026 · GitHub Advisory Database

    Fix available

    lodash fixed in 4.18.0; lodash-es fixed in 4.18.0; lodash-amd fixed in 4.18.0; lodash.unset fixed in 4.18.0

  4. Oct 17, 2026 · GitHub Advisory Database

    Fix available

    lodash fixed in 4.18.0

  5. Oct 17, 2026 · GitHub Advisory Database

    Fix available

    lodash-es fixed in 4.18.0

  6. Oct 17, 2026 · GitHub Advisory Database

    Fix available

    lodash-amd fixed in 4.18.0

  7. Oct 17, 2026 · GitHub Advisory Database

    Fix available

    lodash.unset fixed in 4.18.0

  8. Oct 17, 2026 · GitHub Advisory Database

    Updated

    ### Impact Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the and functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as , , an

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-2950

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in protot

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2026-2950

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-2950

    30-day exploitation probability 0.4%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-f23m-r3pf-42rh

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • NIST NVDVulnerability recordCVE-2026-2950

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in protot

    nvd.nist.gov
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-f23m-r3pf-42rh

    lodash vulnerable to Prototype Pollution via array path bypass in and

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.