EUVD-2026-17591
GHSA-f23m-r3pf-42rh
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V3 - Web Frontend Security Prototype pollution prevention
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) indicates network-accessible, low-complexity, unauthenticated attack with no user interaction required, making exploitation straightforward. However, CVSS impact metrics show only low integrity (I:L) and low availability (I:L) impact-the attacker can delete prototype properties but cannot overwrite their original behavior, significantly limiting real-world damage compared to full prototype pollution vulnerabilities. The 6.5 score reflects this moderate risk. The vulnerability is a partial bypass of a prior security fix (CVE-2025-13465), suggesting the threat model is known and the attack surface is well-understood by the defender community. Without confirmation of public exploit code (POC) or active exploitation (KEV status not provided), this should be prioritized as a medium-risk remediation task rather than an emergency response, though rapid patching is warranted for widespread JavaScript applications. |
| Exploit ScenarioDerived | An attacker controlling user input (e.g., via an HTTP request parameter processed by a server-side Lodash utility, or client-side code in a vulnerable web application) could craft a JSON payload with array-wrapped path segments targeting Object.prototype or Number.prototype properties. By passing this payload to _.unset or _.omit, the attacker deletes sensitive prototype properties, potentially disrupting application logic or triggering denial-of-service by breaking core object functionality. For example, deleting Object.prototype.toString could cause cascading failures in template rendering or logging systems. No public exploit code or active exploitation has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 31, 2026
Prototype pollution in Lodash 4.17.23 and earlier allows unauthenticated remote attackers to delete properties from built-in prototypes (Object.prototype, Number.prototype, String.prototype) via array-wrapped path segments in _.unset and _.omit functions, bypassing the incomplete fix for CVE-2025-13465. The vulnerability has a CVSS score of 6.5 with low integrity and availability impact; no public exploit code or active exploitation has been confirmed at time of analysis.
RemediationAI
Vendor-released patch: Upgrade Lodash to version 4.18.0 or later. This version addresses the incomplete prototype pollution guard by properly validating array-wrapped path segments in _.unset and _.omit functions. No workarounds are available; patching is the only mitigation. For JavaScript projects using npm, package.json should be updated to require lodash@^4.18.0 or lodash-es@^4.18.0 depending on the variant in use. Developers should verify the upgraded version and re-run tests to ensure compatibility with their application code.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 4 packages in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Lodash is a widely-used JavaScript utility library. The vulnerability exists in the prototype pollution guard implemented for _.unset and _.omit functions. The guard checks for string key members but fails to validate array-wrapped path segments, allowing attackers to craft payloads that traverse and delete properties from Object.prototype and other built-in prototypes. This is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), a type of prototype pollution attack. The affected CPE strings indicate all variants are vulnerable: lodash (main package), lodash-es (ES module variant), lodash-amd (AMD module variant), and lodash.unset (single-function package).
Know when Lodash gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Impact:
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.
The issue permits deletion of prototype properties but does not allow overwriting their original behavior.
Patches:
This issue is patched in 4.18.0.
Workarounds:
None. Upgrade to the patched version.
Blast Radius
ecosystem impact- 44 npm packages depend on lodash (26 direct, 18 indirect)
- 1 npm packages depend on lodash-es (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 4.18.0 and other introduced versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Rated high severity (CVS
Server-side code injection in Lodash's _.template function (lodash, lodash-es, lodash-amd and lodash.template, versions
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. Rated critical severity (CVSS 9.1), this vu
Lodash versions up to 4.17.22 is affected by improperly controlled modification of object prototype attributes (prototyp
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. Rated high severity (CVSS 7.4), this vul
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. Rated medium severity (CVSS 6.5), th
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaults
Exploit-DB