Description
The _.unset, _.omit, and _.pullAt functions are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.
Recommendation
Update the lodash-amd package to the latest compatible version. Followings are version details:
- Affected version(s): = 4.17.23
- Patched version(s): 4.18.1
References
Could your website be exposed too?
SmartScanner can check your website for lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt - lodash-amd and gives you actionable findings to investigate.
Start a free scanRelated Issues
- lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt - lodash-es - CVE-2026-2950
- lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt - lodash.unset - CVE-2026-2950
- lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt - CVE-2026-2950
- Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions - lodash-amd - CVE-2025-13465
You might also like:
See something that needs correcting? Let us knowUpdated November 03, 2026