Lodash

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 6.5MediumMar 31, 2026lodashCVE-2026-2950The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1
• 8.1HighMar 31, 2026lodash Code / command injectionCVE-2026-4800The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker ca2.6% likelyExploit code
• 5.3MediumJan 21, 2026lodashCVE-2025-13465The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.1.8% likely
• 7.4HighJul 15, 2020lodash Denial of serviceCVE-2020-8203Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.5.2% likelyExploit code

See every Lodash entry on the dashboard.

Top products

• lodash3 CVEs in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• Atlassian · Sep 15, 2026Atlassian Security Bulletin September 15, 2026CVE-2026-4800
• Atlassian · Jul 21, 2026Atlassian Security Bulletin July 21, 2026CVE-2026-4800