lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

TRUNG BÌNH 5.3CVE-2026-2950 · GHSA-f23m-r3pf-42rh · Công bố 31/03/2026 · cập nhật 15/10/2026

Tóm tắt nhanh

CVE-2026-2950 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng lodash (lodash), lodash-amd (lodash), lodash-es (lodash).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.34%, cao hơn 27.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.17.23, 4.18.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
lodash lodash	`≥ 4.0.0, < 4.17.23`	`4.17.23`
lodash-amd lodash	`≥ 4.0.0, < 4.17.23`	`4.17.23`
lodash-es lodash	`≥ 4.0.0, < 4.17.23`	`4.17.23`
lodash.unset lodash	`≥ 4.0.0`	Chưa có bản vá
lodash npm	`< 4.18.0`	`4.18.0`
lodash-amd npm	`< 4.18.0`	`4.18.0`
lodash-es npm	`< 4.18.0`	`4.18.0`
lodash.unset npm	`≥ 4.0.0, < 4.18.0`	`4.18.0`

Mô tả

Impact

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

Patches

This issue is patched in 4.18.0.

Workarounds

None. Upgrade to the patched version.

Mô tả của NVD

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.