PT-2026-29328 · Lodash+1 · Lodash+1

Backuardo + 9 · Publicado 2026-03-31 · Atualizado 2026-06-09 · CVE-2026-2950

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Lodash versions prior to 4.18.0

Description Lodash versions 4.17.23 and earlier are susceptible to prototype pollution through the .unset and .omit functions. The initial fix did not fully address the issue, as an attacker can bypass the check by using array-wrapped path segments. This allows for the deletion of properties from built-in prototypes like Object.prototype, Number.prototype, and String.prototype. The issue allows deletion of prototype properties but does not permit overwriting their original behavior.

Recommendations Upgrade to version 4.18.0 or later.

Correção

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

CLEANSTART-2026-AD27625

CLEANSTART-2026-BE61221

CLEANSTART-2026-CE10526

CLEANSTART-2026-KS09647

CLEANSTART-2026-LC05413

CLEANSTART-2026-NB51079

CLEANSTART-2026-TW25027

CLEANSTART-2026-TZ34913

CVE-2026-2950

GHSA-F23M-R3PF-42RH

RHSA-2026:7378

RHSA-2026:7655

RHSA-2026:9455

USN-8411-1

Produtos afetados

Lodash

Ubuntu

Referências · 339

• https://github.com/lodash/lodash · Nota
• https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh · Nota
• https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg · Aviso do Fabricante
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LC05413.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BE61221.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AD27625.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-NB51079.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TW25027.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KS09647.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TZ34913.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CE10526.json · Nota
• https://osv.dev/vulnerability/CVE-2026-27144 · Nota
• https://osv.dev/vulnerability/CVE-2026-32280 · Nota
• https://osv.dev/vulnerability/CVE-2026-32141 · Nota
• https://osv.dev/vulnerability/ghsa-23c5-xmqv-rm74 · Nota