lodash.unset vulnerabilities

CVEs whose affected-version data names the lodash.unset package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-2950Medium· 6.5

6mo ago

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows …

▾ Sunlitlodash · lodashEPSS 0.38%via NVD