Prototype pollution in Lodash - CVE-2026-2950

Detailed vulnerability description

The vulnerability allows a remote attacker to modify object prototype attributes.

The vulnerability exists due to improper control of object prototype modification in _.unset and _.omit when processing array-wrapped path segments. A remote attacker can pass crafted path segments to modify object prototype attributes.

The bypass affects checks that only guard against string key members. The issue permits deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype, but does not allow overwriting their original behavior.

How to mitigate CVE-2026-2950

Sources

• https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh
• https://github.com/advisories/GHSA-f23m-r3pf-42rh