Lodash · Lodash · CVE-2026-2950
**Name of the Vulnerable Software and Affected Versions**
Lodash versions prior to 4.18.0
**Description**
Lodash versions 4.17.23 and earlier are susceptible to prototype pollution through the ` .unset` and ` .omit` functions. The initial fix did not fully address the issue, as an attacker can bypass the check by using array-wrapped path segments. This allows for the deletion of properties from built-in prototypes like Object.prototype, Number.prototype, and String.prototype. The issue allows deletion of prototype properties but does not permit overwriting their original behavior.
**Recommendations**
Upgrade to version 4.18.0 or later.