Cloudanix VulnDB

GHSA-f23m-r3pf-42rh

Medium · 6.5

CVSS

6.5

EPSS

—

Published

Apr 1, 2026

CISA due date

—

The record

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Affected packages

Ecosystem Package Introduced Fixed
npm lodash 0 4.18.0
npm lodash-amd 0 4.18.0
npm lodash-es 0 4.18.0
npm lodash.unset 4.0.0 4.18.0
Chainguard arangodb-3.11 0 3.11.14.3-r5
Chainguard arangodb-3.12 0 3.12.7.2-r5
Chainguard argo-workflows-ui-3.6 0 3.6.19-r5
Chainguard argo-workflows-ui-3.7 0 3.7.13-r0
Chainguard argo-workflows-ui-4.0 0 4.0.4-r0
Chainguard code-server 0 4.112.0-r2
Chainguard jitsucom-jitsu-console 0 2.11.0-r19
Chainguard json-server 0 0.17.4-r6
Chainguard kubeflow-centraldashboard 0 1.10.0-r18
Chainguard kubeflow-pipelines-frontend 0 2.16.0-r11
Chainguard langfuse-2 0 2.95.12-r17
Chainguard langfuse-2-worker 0 2.95.12-r17
Chainguard langfuse-fips-2 0 2.95.12-r20
Chainguard langfuse-fips-2-worker 0 2.95.12-r20
Chainguard npm 0 11.12.1-r3
Chainguard opensearch-dashboards-3 0 3.5.0-r12
Chainguard opensearch-dashboards-3-fips 0 3.5.0-r9
Chainguard renovate 0 43.104.7-r1
Chainguard sqlpad 0 7.5.7-r17
Chainguard wazuh-dashboard 0 4.14.4-r1
Chainguard wazuh-dashboard-alerting-dashboards-plugin 0 4.14.4-r1
Chainguard wazuh-dashboard-anomaly-detection-dashboards-plugin 0 4.14.4-r1
Chainguard wazuh-dashboard-plugins 0 4.14.4-r1
Wolfi argo-workflows-ui-3.7 0 3.7.13-r0
Wolfi argo-workflows-ui-4.0 0 4.0.4-r0
Wolfi code-server 0 4.112.0-r2
Wolfi jitsucom-jitsu-console 0 2.11.0-r19
Wolfi json-server 0 0.17.4-r6
Wolfi kubeflow-centraldashboard 0 1.10.0-r18
Wolfi kubeflow-pipelines-frontend 0 2.16.0-r11
Wolfi npm 0 11.12.1-r3
Wolfi opensearch-dashboards-3 0 3.5.0-r12
Wolfi renovate 0 43.104.7-r1
Wolfi sqlpad 0 7.5.7-r17

Related vulnerabilities