PatchSiren

lodash CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM lodash CVE published 2026-03-31

CVE-2026-2950

CVE-2026-2950 is a medium-severity vulnerability in Lodash versions 4.17.23 and earlier. The issue allows for prototype pollution via the _.unset and _.omit functions, enabling deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. However, it does not allow overwriting their original behavior. The vulnerability is patched in version 4.18.0. This [truncated]