---
id: CVE-2026-2950
title: >-
  The _.unset and _.omit functions in Lodash are vulnerable to prototype
  pollution
summary: >-
  The _.unset and _.omit functions in Lodash are vulnerable to prototype
  pollution. The fix for CVE-2025-13465 only guards against string key members,
  so an attacker can bypass the check by passing array-wrapped path segments.
  This allows …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-1321
vendor: lodash
product: lodash
affected:
  - 'lodash >= 4.0.0, < 4.17.23'
  - 'lodash-amd >= 4.0.0, < 4.17.23'
  - 'lodash-es >= 4.0.0, < 4.17.23'
  - lodash.unset >= 4.0.0
patched:
  - lodash 4.17.23
  - lodash-amd 4.17.23
  - lodash-es 4.17.23
published: '2026-03-31'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T07:18:00.143'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-2950'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: 'https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-04-01T13:43:14.280375Z'
epss: 0.00377
epssPercentile: 0.30002
ingestedAt: '2026-10-15T07:57:27.837Z'
---

## Overview

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

## Affected

- `lodash >= 4.0.0, < 4.17.23`
- `lodash-amd >= 4.0.0, < 4.17.23`
- `lodash-es >= 4.0.0, < 4.17.23`
- `lodash.unset >= 4.0.0`

## Remediation

Upgrade past the affected range:

- `lodash 4.17.23`
- `lodash-amd 4.17.23`
- `lodash-es 4.17.23`