What is the CVSS score of CVE-2026-2950?

CVE-2026-2950 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-2950?

Yes, a patch is available for CVE-2026-2950. Update the affected software to the latest version immediately.

Prototype Pollution CVE-2026-2950

EUVD-2026-17591 MEDIUM

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-03-31 openjs

GHSA-f23m-r3pf-42rh

Prototype Pollution Authentication Bypass Red Hat

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Apr 02, 2026 - 14:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 19:47 euvd

EUVD-2026-17591

Analysis Generated

Mar 31, 2026 - 19:47 vuln.today

CVE Published

Mar 31, 2026 - 19:18 nvd

MEDIUM 6.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

35 npm packages depend on lodash (18 direct, 17 indirect)
1 npm packages depend on lodash-es (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 4.18.0 and other introduced versions.

DescriptionCVE.org

Impact:

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.

The issue permits deletion of prototype properties but does not allow overwriting their original behavior.

Patches:

This issue is patched in 4.18.0.

Workarounds:

None. Upgrade to the patched version.

AnalysisAI

Prototype pollution in Lodash 4.17.23 and earlier allows unauthenticated remote attackers to delete properties from built-in prototypes (Object.prototype, Number.prototype, String.prototype) via array-wrapped path segments in _.unset and _.omit functions, bypassing the incomplete fix for CVE-2025-13465. The vulnerability has a CVSS score of 6.5 with low integrity and availability impact; no public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

Lodash is a widely-used JavaScript utility library. The vulnerability exists in the prototype pollution guard implemented for _.unset and _.omit functions. The guard checks for string key members but fails to validate array-wrapped path segments, allowing attackers to craft payloads that traverse and delete properties from Object.prototype and other built-in prototypes. This is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), a type of prototype pollution attack. The affected CPE strings indicate all variants are vulnerable: lodash (main package), lodash-es (ES module variant), lodash-amd (AMD module variant), and lodash.unset (single-function package).

RemediationAI

Vendor-released patch: Upgrade Lodash to version 4.18.0 or later. This version addresses the incomplete prototype pollution guard by properly validating array-wrapped path segments in _.unset and _.omit functions. No workarounds are available; patching is the only mitigation. For JavaScript projects using npm, package.json should be updated to require lodash@^4.18.0 or lodash-es@^4.18.0 depending on the variant in use. Developers should verify the upgraded version and re-run tests to ensure compatibility with their application code.