lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-es

Description

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

Recommendation

Update the lodash-es package to the latest compatible version. Followings are version details:

• Affected version(s): <= 4.17.23
• Patched version(s): 4.18.0

References

• GHSA-f23m-r3pf-42rh
• CVE-2026-2950
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash.unset - CVE-2026-2950
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - CVE-2026-2950
• lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` - lodash-amd - CVE-2026-2950
• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-es - CVE-2025-13465

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

lodash-es