lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass

🗓️ 11 Apr 2026 00:49:50Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

Lodash prototype pollution allows deleting built in prototypes via array path segments.

Reporter	Title	Published	Views	Family All 136
ibm	Security Bulletin: Multiple Vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI	26 May 202614:03	–	ibm
ibm	Security Bulletin: Vulnerabilities in lodash, cryptography and axios might affect IBM Storage Defender Sentinel Anomaly Scan Engine.	26 Jun 202616:53	–	ibm
ibm	Security Bulletin: Langflow OSS affected by vulnerabilies in Lodash versions 4.17.23 and earlier	8 Jun 202618:38	–	ibm
ibm	Security Bulletin: : Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in dependencies	8 Jun 202614:50	–	ibm
ibm	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for April 2026	30 Apr 202611:49	–	ibm
ibm	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in lodash and lodash-es (CVE-2026-2950, CVE-2026-4800)	2 Jun 202611:19	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	5 Jun 202610:12	–	ibm
ibm	Security Bulletin: Carbon Charts lodash-es Security Vulnerabilities	27 Apr 202607:10	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (May 2026)	14 May 202601:21	–	ibm
ibm	Security Bulletin: Multiple security vulnerabilities addressed with IBM Business Automation Workflow cumulative fixes June 2026	29 Jun 202610:18	–	ibm

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Hardened Images	20251124	aarch64	yarnpkg	1.22.22-18.1.hum1	yarnpkg-1.22.22-18.1.hum1.aarch64.rpm
Red Hat Hardened Images	20251124	x86_64	yarnpkg	1.22.22-18.1.hum1	yarnpkg-1.22.22-18.1.hum1.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-2950
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-2950
cve	www.cve.org/CVERecord

15 Jul 2026 14:31Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.15.3 - 6.5

EPSS0.00317

SSVC

lodash prototype pollution unset function omit function built in prototypes security bypass denial of service array path segments