Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-2950

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Lodash
Products
Lodash Lodash-amd Lodash-es and 1 more
CVE-2026-4800

lodash vulnerable to Code Injection via `_.template` imports key names

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.

CVSS 3.1 · 8.1 High EPSS 2.8% KEV · Not listed
Vendors
Lodash
Products
Lodash Lodash-amd Lodash-es and 1 more
CVE-2025-13465

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

CVSS 4.0 · 6.9 Medium EPSS 1.8% KEV · Not listed
Vendors
Lodash
Products
Lodash
CVE-2019-10744

nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

CVSS 3.1 · 9.1 Critical EPSS 5.0% KEV · Not listed
Vendors
F5 Lodash Netapp and 2 more
Products
Big-ip Access Policy Manager Big-ip Advanced Firewall Manager Big-ip Analytics and 23 more
CVE-2019-1010266

lodash: uncontrolled resource consumption in Data handler causing denial of service

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

CVSS 3.1 · 6.5 Medium EPSS 3.0% KEV · Not listed
Vendors
Lodash Redhat
Products
Lodash Quay
CVE-2018-3721

lodash: Prototype pollution in utilities function

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

CVSS 3.1 · 6.5 Medium EPSS 2.3% KEV · Not listed
Vendors
Lodash Netapp Redhat
Products
Lodash Active Iq Unified Manager System Manager and 1 more
CVE-2018-16487

lodash: Prototype pollution in utilities function

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

CVSS 3.1 · 5.6 Medium EPSS 1.5% KEV · Not listed
Vendors
Lodash
Products
Lodash