Listen to this Post
The vulnerability in Lodash arises from the `_.unset` and `_.omit` functions in versions 4.0.0 through 4.17.22. Prototype pollution occurs when user input is used to modify the prototype of base objects, such as Object.prototype. In this case, an attacker can craft specific paths that cause Lodash to traverse the prototype chain during property deletion operations. When `_.unset` or `_.omit` processes these paths, it may inadvertently delete properties from global prototypes instead of the intended target object. This is due to insufficient validation of path parameters, allowing special characters or array indices to reference prototype properties. The deletion affects methods like `toString` or `valueOf` on Object.prototype, potentially causing denial of service or breaking application functionality that relies on these methods. Importantly, this vulnerability only permits deletion of properties, not overwriting, which limits the attack to removal rather than injection of malicious code. The issue stems from the internal path handling mechanism in Lodash, which fails to restrict access to prototype chains when resolving property keys. Attackers exploit this by passing paths like `__proto__.toString` or constructor.prototype.value, leading to unwanted deletion from prototypes. This can impact any application using vulnerable Lodash functions with untrusted input, such as from HTTP requests or user data. The mitigation involves updating to Lodash 4.17.23, where path validation prevents prototype pollution.
Platform: Lodash
Version: <=4.17.22
Vulnerability: Prototype Pollution
Severity: Moderate
date: Jan 21, 2026
Prediction: Patch 4.17.23
What Undercode Say:
npm list lodash npm audit fix
const _ = require('lodash');
// Crafted path for pollution
_.unset({}, '<strong>proto</strong>.toString');
Exploit:
Craft paths like `__proto__.method` in `_.unset` or `_.omit` calls with untrusted data to delete prototype properties, causing app crashes or behavior changes.
Protection from this CVE
Update Lodash to version 4.17.23 or higher using npm update lodash.
Impact:
Denial of service, broken functionality due to deleted prototype methods.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
