GHSA-f23m-r3pf-42rh: lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Summary
Lodash versions 4.17.23 and earlier have a vulnerability in the `_.unset` and `_.omit` functions that allows prototype pollution (modifying built-in object templates like Object.prototype that affect all objects). An attacker can bypass the previous security fix by using array-wrapped path segments to delete properties from these core prototypes, though they cannot change how those prototypes work.
Solution / Mitigation
Upgrade to Lodash version 4.18.0 or later. The source states: 'This issue is patched in 4.18.0.'
Vulnerability Details
EPSS: 0.0%
Yes
April 1, 2026
Classification
Affected Packages
Related Issues
Original source: https://github.com/advisories/GHSA-f23m-r3pf-42rh
First tracked: April 1, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 75%