Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
The issue permits deletion of properties but does not allow overwriting their original behavior.
This issue is patched on 4.17.23
CVSS Details
- CVSS 4.0 Base Score: 6.9 (MEDIUM)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade sgx-pckid-toolUpgrade pcs-snmpUpgrade sgx-commonUpgrade sgx-pccsUpgrade tdx-qgsUpgrade sgx-libsUpgrade sgx-pccs-adminUpgrade pcsUpgrade sgx-mpa | Feb 13, 2026 | Feb 10, 2026 |
| Debian | — | Upgrade node-lodash | Jul 5, 2026 | Jul 5, 2026 |
| Oracle_linux | — | Upgrade pcs-snmpUpgrade cockpit-ha-clusterUpgrade pcs | Feb 12, 2026 | Jan 21, 2026 |
| Red Hat Jboss Eap | — | — | Jan 27, 2026 | Jan 21, 2026 |
| Redhat_linux | — | Upgrade tdx-qgsUpgrade linux-sgx-debuginfoUpgrade linux-sgx-debugsourceUpgrade sgx-mpaUpgrade sgx-pccs-debuginfoUpgrade pcsUpgrade tdx-attest-libs-debuginfoUpgrade sgx-enclave-devel-debuginfoUpgrade tdx-qgs-debuginfoUpgrade sgx-libsUpgrade cockpit-ha-clusterUpgrade sgx-pccs-adminUpgrade pcs-snmpUpgrade sgx-libs-debuginfoUpgrade cockpit-image-builderNo solution existsUpgrade sgx-pccsUpgrade sgx-commonUpgrade sgx-pckid-toolUpgrade sgx-mpa-debuginfoUpgrade sgx-pckid-tool-debuginfo | Feb 11, 2026 | Jan 21, 2026 |
| Rocky_linux | — | Upgrade linux-sgx-debugsourceUpgrade linux-sgx-debuginfoUpgrade sgx-pckid-tool-debuginfoUpgrade tdx-qgs-debuginfoUpgrade pcs-snmpUpgrade sgx-commonUpgrade sgx-mpaUpgrade sgx-pccs-adminUpgrade sgx-pccsUpgrade tdx-qgsUpgrade sgx-pccs-debuginfoUpgrade pcsUpgrade sgx-libsUpgrade sgx-libs-debuginfoUpgrade sgx-mpa-debuginfoUpgrade sgx-pckid-tool | Feb 16, 2026 | Feb 13, 2026 |
| Ubuntu | — | No solution existsUpgrade node-lodashUpgrade node-lodash-packages (Ubuntu Pro)Upgrade libjs-lodash (Ubuntu Pro)Upgrade node-lodash-packagesUpgrade libjs-lodashUpgrade node-lodash (Ubuntu Pro) | Jun 16, 2026 | Jun 9, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub