---
cve: "CVE-2026-2950"
severity: "MEDIUM"
cvss: 6.5
epss: "32%"
vendor: "lodash"
kev: false
exploited: false
published: "2026-03-31 20:16:26"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-07T05:48:47+02:00"
---

# CVE-2026-2950

> 6.5 MEDIUM · 🧪 PoC

## Beschreibung

Impact:

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

Patches:

This issue is patched in 4.18.0.

Workarounds:

None. Upgrade to the patched version.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Gering | warn |
| A Verfügbarkeit | Gering | warn |

## Patch verfügbar (OSV)

- 835a537f36ee2fd5fb7f524e213ff9ba2d8698f8 (Commit)

## Referenzen

- <https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-2950) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_