What is the CVSS score of CVE-2026-2950?

CVE-2026-2950 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-2950?

Yes, a patch is available for CVE-2026-2950. Update the affected software to the latest version immediately.

Prototype Pollution CVE-2026-2950

EUVD-2026-17591 MEDIUM

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-03-31 openjs

GHSA-f23m-r3pf-42rh

Authentication Bypass Prototype Pollution Lodash Lodash Es Lodash Amd Lodash Unset

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jul 24, 2026 - 20:22 NVD

6.5 (MEDIUM) 5.3 (MEDIUM)

Patch released

Apr 02, 2026 - 14:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 19:47 euvd

EUVD-2026-17591

Analysis Generated

Mar 31, 2026 - 19:47 vuln.today

CVE Published

Mar 31, 2026 - 19:18 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

39 npm packages depend on lodash (21 direct, 18 indirect)
1 npm packages depend on lodash-es (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.18.0 and other introduced versions.

DescriptionNVD

Impact:

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

Patches:

This issue is patched in 4.18.0.

Workarounds:

None. Upgrade to the patched version.

AnalysisAI

Prototype pollution in Lodash 4.17.23 and earlier allows unauthenticated remote attackers to delete properties from built-in prototypes (Object.prototype, Number.prototype, String.prototype) via array-wrapped path segments in _.unset and _.omit functions, bypassing the incomplete fix for CVE-2025-13465. The vulnerability has a CVSS score of 6.5 with low integrity and availability impact; no public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

Lodash is a widely-used JavaScript utility library. The vulnerability exists in the prototype pollution guard implemented for _.unset and _.omit functions. The guard checks for string key members but fails to validate array-wrapped path segments, allowing attackers to craft payloads that traverse and delete properties from Object.prototype and other built-in prototypes. This is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), a type of prototype pollution attack. The affected CPE strings indicate all variants are vulnerable: lodash (main package), lodash-es (ES module variant), lodash-amd (AMD module variant), and lodash.unset (single-function package).

RemediationAI

Vendor-released patch: Upgrade Lodash to version 4.18.0 or later. This version addresses the incomplete prototype pollution guard by properly validating array-wrapped path segments in _.unset and _.omit functions. No workarounds are available; patching is the only mitigation. For JavaScript projects using npm, package.json should be updated to require lodash@^4.18.0 or lodash-es@^4.18.0 depending on the variant in use. Developers should verify the upgraded version and re-run tests to ensure compatibility with their application code.