Skip to content
OpenAdvisories

Package · npm

lodash.omit

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-2950

    lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties…

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm
  • Medium 6.9
    CVE-2025-13465 Public exploit

    Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

    The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their ori…

    lodash lodash lodash-amd lodash-es Debian Ubuntu Wolfi npm