Home
Trends
Vulnerabilities
News
Researchers
Why dbugs?

Backuardo

#40635of 53,622
6.5Total CVSS
Vulnerabilities · 1
PT-2026-29328
6.5
2026-03-31
Lodash · Lodash · CVE-2026-2950
**Name of the Vulnerable Software and Affected Versions** Lodash versions prior to 4.18.0 **Description** Lodash versions 4.17.23 and earlier are susceptible to prototype pollution through the ` .unset` and ` .omit` functions. The initial fix did not fully address the issue, as an attacker can bypass the check by using array-wrapped path segments. This allows for the deletion of properties from built-in prototypes like Object.prototype, Number.prototype, and String.prototype. The issue allows deletion of prototype properties but does not permit overwriting their original behavior. **Recommendations** Upgrade to version 4.18.0 or later.