#VU125804 Prototype pollution in Lodash - CVE-2026-2950
Published: April 10, 2026
Vulnerability identifier: #VU125804
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-2950
CWE-ID: CWE-1321
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Lodash
Lodash
Software vendor:
Lodash
Lodash
Description
The vulnerability allows a remote attacker to modify object prototype attributes.
The vulnerability exists due to improper control of object prototype modification in _.unset and _.omit when processing array-wrapped path segments. A remote attacker can pass crafted path segments to modify object prototype attributes.
The bypass affects checks that only guard against string key members. The issue permits deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype, but does not allow overwriting their original behavior.
Remediation
Install security update from vendor's website.