GHSA-f23m-r3pf-42rhPublished
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-2950 · Microsoft / collected KEV context
cve-program · CVE-2026-2950
- https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
- https://cna.openjsf.org/security-advisories.html
euvd · EUVD-2026-17591
- https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
- https://cna.openjsf.org/security-advisories.html
nvd · CVE-2026-2950
- https://cna.openjsf.org/security-advisories.html
- https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
osv · GHSA-f23m-r3pf-42rh
- https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
- https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
- https://nvd.nist.gov/vuln/detail/CVE-2026-2950
- https://github.com/lodash/lodash/commit/4f0e376589e1889e8993e212a5c9041112ad178e
- https://github.com/lodash/lodash/commit/87e6676934f7b4450fad68c35f0325ba165b48f8
- https://github.com/lodash/lodash/commit/bbcf0036d27ef936f175bf26e73e247994d8e1e4
- https://github.com/lodash/lodash/commit/db27b6bb14b12a1451b20edf87dfe307b87a337d
- https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b
- https://cna.openjsf.org/security-advisories.html
- https://github.com/lodash/lodash
- https://github.com/lodash/lodash/releases/tag/4.18.1
Related operational evidence
Explicit CVE identifiers- lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt · Source adds a fixed version · 3 Nov 2026