CVE-2026-2950

The vulnerability allows an attacker to delete properties from built-in JavaScript prototypes by providing array-wrapped path segments to the lodash _.unset and _.omit functions. This prototype pollution can remove properties from Object.prototype, Number.prototype, and String.prototype, potentially altering the behavior of all objects and strings in the running application. Though it does not enable overwriting of those properties, the removal of standard behaviors can lead to unexpected errors or subtle logic failures, affecting the integrity of the application.

The issue affects all official lodash distributions prior to version 4.18.0, including lodash, lodash-amd, lodash-es, and lodash.unset. Projects that depend on any of these NPM packages, especially those that use _.unset or _.omit on untrusted input, are vulnerable. The patch was released in lodash 4.18.0.

The CVSS score of 6.5 indicates a medium severity. The EPSS score is below 1%, suggesting a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker can provide crafted input to a code path that calls _.unset or _.omit, which is common in many template parsing or configuration handling modules. If exploited, an attacker could disrupt application logic by removing essential prototype properties.