TI-2026-02542 CVE-2026-2950 · GHSA-f23m-r3pf-42rh
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Priority LOW 35
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
lodash
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
lodash records in CISA KEVNo lodash vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
1 record in Lodash.unset · all components