CVE-2026-2950
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
Published Mar 31, 2026 · updated Oct 15, 2026 · lodash lodash
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
Timeline
Detection, updates, and resolution for this record.
Mar 31, 2026 · NIST NVD
Detected
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype propertie
Oct 15, 2026 · NIST NVD
Updated
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype propertie
Affected
- cpe lodash/lodashversion unspecified
- cpe lodash/lodash-amdversion unspecified
- cpe lodash/lodash-esversion unspecified
- cpe lodash/lodash.unsetversion unspecified
- vendor lodash lodashversion unspecified
- vendor lodash lodash-amdversion unspecified
- vendor lodash lodash-esversion unspecified
- vendor lodash lodash.omitversion unspecified
- vendor lodash lodash.unsetversion unspecified
Sources
- CIRCL Vulnerability LookupCVE-2026-2950
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in protot
vulnerability.circl.lu - CVE.orgCVE-2026-2950
Official CVE identifier
cve.org - NIST NVDCVE-2026-2950
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in protot
nvd.nist.gov