GHSA-xxjr-mmjv-4gpg

Suggest an improvement
Source
https://github.com/advisories/GHSA-xxjr-mmjv-4gpg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-xxjr-mmjv-4gpg
Aliases
Downstream
CGA (411)
CLEANSTART (3)
ECHO (1)
MINI (28)
Published
2026-01-21T23:01:22Z
Modified
2026-11-04T03:15:11Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P CVSS Calculator
Summary
Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions
Details

Impact

The _.unset, _.omit, and _.pullAt functions are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

Patches

The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Workarounds

None. Upgrade to the patched version.

Database specific 
{
    "cwe_ids": [
        "CWE-1321"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-21T23:01:22Z",
    "nvd_published_at": "2026-01-21T20:16:05Z",
    "severity": "MODERATE"
}
References

Affected packages

npm / lodash

Package

Name
lodash
View open source insights on deps.dev
Purl
pkg:npm/lodash

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.17.23

Database specific

last_known_affected_version_range 
"<= 4.17.22"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json"

npm / lodash-amd

Package

Name
lodash-amd
View open source insights on deps.dev
Purl
pkg:npm/lodash-amd

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.17.23

Database specific

last_known_affected_version_range 
"<= 4.17.22"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json"

npm / lodash-es

Package

Name
lodash-es
View open source insights on deps.dev
Purl
pkg:npm/lodash-es

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.17.23

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json"

npm / lodash.omit

Package

Name
lodash.omit
View open source insights on deps.dev
Purl
pkg:npm/lodash.omit

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.18.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json"

npm / lodash.unset

Package

Name
lodash.unset
View open source insights on deps.dev
Purl
pkg:npm/lodash.unset

Affected ranges

Type
SEMVER
Events
Introduced
4.0.0
Fixed
4.18.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json"