6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-2950

CVE-2026-2950: lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Impact

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

Patches

This issue is patched in 4.18.0.

Workarounds

None. Upgrade to the patched version.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-2950

CVE-2026-2950:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
lodash	npm	<= 4.17.23	4.18.0
lodash-es	npm	<= 4.17.23	4.18.0
lodash-amd	npm	<= 4.17.23	4.18.0
lodash.unset	npm	>= 4.0.0, < 4.18.0	4.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a prototype pollution issue in the lodash library, specifically within the baseUnset function, which is utilized by the public-facing _.unset and _.omit functions. The root cause was an inadequate validation of property paths provided to these functions. The prior implementation had a check to block paths containing constructor.prototype, but this was easily bypassed. Attackers could wrap malicious path segments like 'constructor' in an array (e.g., [['constructor']]). The code's typeof key !== 'string' check would then cause the validation to be skipped, as the type of the array is 'object'. This allowed for traversal up the prototype chain and the deletion of properties from built-in JavaScript object prototypes.

The patch resolves this by strengthening the validation logic. It now normalizes each segment of the path using a toKey() function before validation. Subsequently, it unconditionally blocks any path that includes either 'constructor' or 'prototype' as an intermediate (non-terminal) segment. This effectively prevents any attempt to traverse into and modify the prototypes of built-in objects. The public functions _.unset and _.omit are the primary vectors through which this vulnerability could be exploited.

Vulnerable functions

baseUnset

lodash.js

The `baseUnset` function contained insufficient checks to prevent prototype pollution. The validation for `constructor.prototype` paths could be bypassed by passing path segments as arrays (e.g., `[['constructor']]`), as the code only checked for string keys. This allowed attackers to delete properties from built-in object prototypes.

unset

lodash.js

The public `unset` function is an entry point for the vulnerability because it directly calls the vulnerable `baseUnset` function without any additional validation on the path argument. An attacker can supply a malicious path to `_.unset` to trigger the prototype pollution.

omit

lodash.js

The public `omit` function is also an entry point for the vulnerability. It internally uses logic that is susceptible to the same path-based traversal issue fixed in `baseUnset`, allowing an attacker to craft a path that leads to the deletion of properties from object prototypes.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.