lodash-es vulnerabilities
CVEs whose affected-version data names the lodash-es package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-2950Medium· 6.5The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows …
▾ Sunlitlodash · lodashEPSS 0.33%via NVD
CVE-2026-4800High· 8.1PoCThe fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application pass…
▾ Midnightlodash · lodashEPSS 2.8%via NVD