Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Lodash | lodash | unaffected |
|
|||||||||
| Lodash | lodash-amd | unaffected |
|
|||||||||
| Lodash | lodash-es | unaffected |
|
|||||||||
| Lodash | lodash.unset | unaffected |
|
|||||||||
| Lodash | lodash.omit | unaffected |
|
No data.
| Vendor | Product | Versions |
|---|---|---|
| Lodash | Lodash | — |
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-4663-1 | node-lodash security update |
Debian DLA |
DLA-4820-1 | node-lodash security update |
Github GHSA |
GHSA-xxjr-mmjv-4gpg | Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions |
Ubuntu USN |
USN-8411-1 | Lodash vulnerabilities |
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: 1.8% (1.823% probability within 30 days)
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23 | The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0. |
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* | |
| Metrics |
cvssV3_1
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Lodash
Lodash lodash |
|
| Vendors & Products |
Lodash
Lodash lodash |
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23 | |
| Title | Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions | |
| Weaknesses | CWE-1321 | |
| References |
| |
| Metrics |
cvssV4_0
|
View source · Bugzilla · JSON
OpenCVE enrichment
Updated: Jan 22, 2026, 10:08 AM
Debian DLA
Github GHSA
Ubuntu USN