Skip to content
Fencer Vulns
medium 6.5

CVE-2026-2950 json

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

published 2026-03-31 7 mo ago modified 2026-11-03 5 d ago also GHSA-f23m-r3pf-42rh , EUVD-2026-17591

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Patch / fix

  • npm lodash 4.18.1
  • npm lodash-es 4.18.1
  • npm lodash-amd 4.18.1
  • npm lodash.unset 4.18.0
  • npm lodash.omit 4.18.0
  • lodash lodash 4.18.1
  • lodash lodash-es 4.18.1
  • lodash lodash-amd 4.18.1
  • lodash lodash.unset 4.18.0
  • lodash lodash.omit 4.18.0
  • node-lodash Debian 12 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1
  • node-lodash Debian 13 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
  • node-lodash Debian 14 4.18.1+dfsg-1

debian advisories DEBIAN-CVE-2026-2950

  • node-lodash Ubuntu 25.10 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1
  • node-lodash Ubuntu Pro 16.04 LTS 2.4.1+dfsg-3ubuntu0.1~esm1
  • node-lodash Ubuntu Pro 18.04 LTS 4.17.4+dfsg-1ubuntu0.1~esm1
  • node-lodash Ubuntu Pro 20.04 LTS 4.17.15+dfsg-2ubuntu0.1~esm1
  • node-lodash Ubuntu Pro 22.04 LTS 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1
  • node-lodash Ubuntu Pro 24.04 LTS 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1
  • node-lodash Ubuntu Pro 26.04 LTS 4.17.23+dfsg-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2026-2950

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cockpit RHEL 10.2 356.1-1.el10_2
  • cockpit-ws RHEL 10.2 356.1-1.el10_2
  • cockpit-bridge RHEL 10.2 356.1-1.el10_2
  • cockpit-system RHEL 10.2 356.1-1.el10_2
  • cockpit-storaged RHEL 10.2 356.1-1.el10_2
  • cockpit-packagekit RHEL 10.2 356.1-1.el10_2
  • cockpit-ws-selinux RHEL 10.2 356.1-1.el10_2
  • cockpit RHEL 9 356.1-1.el9_8

red hat advisories RHBA-2026:21388RHBA-2026:21387RHSA-2026:9455RHSA-2026:7655RHSA-2026:7378

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-2950 updated cvss 6.5

lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass

  • Red Hat Confidential Compute Attestation openshift-sandboxed-containers/osc-pccs Red Hat Cryostat 4 lodash, cryostat-openshift-console-plugin-npm Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel8, mta/mta-ui-rhel9 Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-console-plugin-rhel9, migration-toolkit-virtualization/mtv-console-plugin-rhel9
    +26 more products
    Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9 Red Hat Network Observability Operator network-observability/network-observability-console-plugin-rhel9, network-observability/network-observability-console-plugin-compat-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-remediation-console-rhel9, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat 3scale API Management Platform 2 3scale-amp21/system, 3scale-amp22/system, 3scale-amp2/system-rhel7, 3scale-amp2/system-rhel8, 3scale-amp2/system-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-main-rhel8 Red Hat Ansible Automation Platform 2 automation-hub, python-galaxy-ng, automation-gateway, python3x-galaxy-ng, python3.11-galaxy-ng, python3.12-galaxy-ng, +9 more Red Hat build of Apache Camel - HawtIO 4 lodash Red Hat build of Apicurio Registry 2 lodash Red Hat build of Apicurio Registry 3 apicurio/apicurio-studio-ui-rhel8, apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9 Red Hat Build of Keycloak lodash Red Hat Build of Podman Desktop podman-desktop-macos-1-0, podman-desktop-windows-1-0 Red Hat Ceph Storage 4 ceph, librbd1, librgw2, rbd-nbd, ceph-mds, ceph-mgr, +27 more Red Hat Connectivity Link 1 rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 lodash Red Hat Developer Hub 1 rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor Red Hat Directory Server 11 389-ds-base Red Hat Directory Server 12 389-ds-base Red Hat Directory Server 13 389-ds-base Red Hat Discovery 2 discovery/discovery-ui-rhel9 Red Hat Edge Manager 1 rhem/flightctl-ui-rhel9, rhem/flightctl-ui-ocp-rhel9 Red Hat Enterprise Linux 7 firefox
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Enterprise Linux 8 pcs, cockpit, firefox, grafana, mozjs60, pcs-snmp, +31 more
    affected: workaround, no fix available, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 gjs, ipa, pcs, firefox, grafana, librbd1, +44 more Red Hat Enterprise Linux 10 gjs, ipa, pcs, ceph, firefox, grafana, +10 more Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 lodash Red Hat JBoss Enterprise Application Platform 7 lodash Red Hat JBoss Enterprise Application Platform 8 lodash
    +1 more products
    Red Hat JBoss Enterprise Application Platform Expansion Pack lodash
    affected: workaround, no fix available “Fix deferred”

16 more affected, 6 more fixed, 2 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm lodash
>=4.17.23, <4.18.1
4.18.1
npm lodash-es
>=4.17.23, <4.18.1
4.18.1
npm lodash-amd
>=4.17.23, <4.18.1
4.18.1
npm lodash.unset
<4.18.0
4.18.0
npm lodash.omit
<4.18.0
4.18.0

Affected products

  • lodash lodash
  • lodash lodash-es
  • lodash lodash-amd
  • lodash lodash.unset
  • lodash lodash.omit

Classification

Weakness
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.