Description
The _.unset, _.omit, and _.pullAt functions are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.
Recommendation
Update the lodash.unset package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.18.0
- Patched version(s): 4.18.0
References
Could your website be exposed too?
SmartScanner can check your website for lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt - lodash.unset and gives you actionable findings to investigate.
Start a free scanRelated Issues
- lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt - lodash-amd - CVE-2026-2950
- lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt - lodash-es - CVE-2026-2950
- lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt - CVE-2026-2950
- dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() - CVE-2026-27837
You might also like:
See something that needs correcting? Let us knowUpdated November 03, 2026