{"id":"GHSA-f23m-r3pf-42rh","revision":"f0c7c041a5824734a5d57288bae0245f","records":[{"revision":"f0c7c041a5824734a5d57288bae0245f","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-f23m-r3pf-42rh","aliases":["CVE-2026-2950"],"title":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","description":"### Impact\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\n### Patches\n\nThis issue is patched in 4.18.0.\n\n### Workarounds\n\nNone. Upgrade to the patched version.","state":0,"publishedAt":"2026-04-01T23:50:27+00:00","modifiedAt":"2026-10-17T02:56:13.0843623+00:00","affected":[{"ecosystem":"npm","name":"lodash","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.18.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash-es","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.18.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash-amd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.18.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash.unset","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.18.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950","https://github.com/lodash/lodash"],"sourceUrl":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f23m-r3pf-42rh","identifiers":["GHSA-f23m-r3pf-42rh","CVE-2026-2950"]},"retained":false,"historicalAffected":[]}],"coverage":[]}