Lodash
Lodash Security Releases - March 2026
lodash-2026-03 Mar 1, 2026 Source: Vendor
Lodash security advisories for March 2026, compiled from CVE.org records.
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://www.cve.org/CVERecord?id=CVE-2026-2950
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
11 lines
Showing 1–11 of 11 matching , clear filters
CVE-2026-2950
BR2026-0000-032339
lodash, lodash-es, lodash-amd
unclaimed
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing a...
Credited as Haruna38
CVE-2026-2950
BR2026-0000-032340
lodash, lodash-es, lodash-amd
unclaimed
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing a...
Credited as shpik-kr
CVE-2026-2950
BR2026-0000-032341
lodash, lodash-es, lodash-amd
unclaimed
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing a...
Credited as maru1009
CVE-2026-2950
BR2026-0000-032342
lodash, lodash-es, lodash-amd
unclaimed
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing a...
Credited as ott3r07
CVE-2026-2950
BR2026-0000-032343
lodash, lodash-es, lodash-amd
unclaimed
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing a...
Credited as zolbooo
CVE-2026-2950
BR2026-0000-032344
lodash, lodash-es, lodash-amd
unclaimed
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing a...
Credited as backuardo
CVE-2026-2950
BR2026-0000-032345
lodash, lodash-es, lodash-amd
unclaimed
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing a...
Credited as jdalton
CVE-2026-4800
BR2026-0000-032346
lodash, lodash-es, lodash-amd
unclaimed
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() co...
Credited as dolevmiz1
CVE-2026-4800
BR2026-0000-032347
lodash, lodash-es, lodash-amd
unclaimed
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() co...
Credited as bugbunny-research
CVE-2026-4800
BR2026-0000-032348
lodash, lodash-es, lodash-amd
unclaimed
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() co...
Credited as M0nd0R
CVE-2026-4800
BR2026-0000-032349
lodash, lodash-es, lodash-amd
unclaimed
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() co...
Credited as threalwinky