From 3938c30b676bf2ab8686fa030a6eb9d0e965bd86 Mon Sep 17 00:00:00 2001 From: Erlend Oftedal Date: Wed, 26 Aug 2026 10:05:51 +0200 Subject: [PATCH] Improve GHSA-f23m-r3pf-42rh --- .../2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json b/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json index c2359e17a31f..9385f769003a 100644 --- a/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json +++ b/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-f23m-r3pf-42rh", - "modified": "2026-04-01T23:50:27Z", + "modified": "2026-04-01T23:50:28Z", "published": "2026-04-01T23:50:27Z", "aliases": [ "CVE-2026-2950" ], - "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`", - "details": "### Impact\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\n### Patches\n\nThis issue is patched in 4.18.0.\n\n### Workarounds\n\nNone. Upgrade to the patched version.", + "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset`, `_.omit` and `_.pullAt`", + "details": "### Impact\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the `_.unset`, `_.omit`, and `_.pullAt` functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\n### Patches\n\nThis issue is patched in 4.18.0.\n\n### Workarounds\n\nNone. Upgrade to the patched version.", "severity": [ { "type": "CVSS_V3",