{"id":"CVE-2026-2950","aliases":["CLSA-2026-1777336764","CLSA-2026-1778633139","CLSA-2026-1784596286","CLSA-2026-1785291645","CLSA-2026-1785291646","CLSA-2026-1785468076","CLSA-2026-1785468081","CLSA-2026-1785468082","CLSA-2026-1791293623","CLSA-2026-1792102343","CLSA-2026-1792327052","CLSA-2026-1792762945","CLSA-2026-1792869761","DEBIAN-CVE-2026-2950","EUVD-2026-17591","GHSA-f23m-r3pf-42rh","RHBA-2026:21387","RHBA-2026:21388","RHSA-2026:7378","RHSA-2026:7655","RHSA-2026:9455","ROOT-APP-NPM-CVE-2026-2950","UBUNTU-CVE-2026-2950","USN-8411-1"],"status":"published","title":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00337,"percentile":0.27462,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-03-31T19:18:35Z","modified":"2026-11-03T15:45:08Z","fixes":[{"ecosystem":"npm","package":"lodash","fixed_in":["4.18.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"lodash-es","fixed_in":["4.18.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"lodash-amd","fixed_in":["4.18.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"lodash.unset","fixed_in":["4.18.0"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"lodash.omit","fixed_in":["4.18.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"lodash","fixed_in":["4.5.0-tuxcare.8","4.17.15-tuxcare.11"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.clone","fixed_in":["4.5.0-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.clonedeepwith","fixed_in":["4.5.0-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.difference","fixed_in":["4.5.0-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.flatmap","fixed_in":["4.5.0-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.foreach","fixed_in":["4.5.0-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.isequal","fixed_in":["4.5.0-tuxcare.8","4.5.0-tuxcare.10"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.uniq","fixed_in":["4.5.0-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.uniqwith","fixed_in":["4.5.0-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.xor","fixed_in":["4.5.0-tuxcare.8"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.clonedeep","fixed_in":["4.5.0-tuxcare.8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-lodash","fixed_in":["4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-lodash","fixed_in":["4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-lodash","fixed_in":["4.18.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"lodash","fixed_in":["4.17.21-aikido.2","4.17.23-aikido.2","4.17.21-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"lodash-es","fixed_in":["4.17.23-aikido.2","4.17.21-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/lodash","fixed_in":["4.17.21-root.io.2","4.17.21-root.io.1","4.17.23-root.io.1","4.17.23-root.io.2","4.17.21-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/lodash-es","fixed_in":["4.17.21-root.io.3","4.17.23-root.io.1","4.17.23-root.io.2","4.17.21-root.io.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-lodash","fixed_in":["2.4.1+dfsg-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-lodash","fixed_in":["4.17.4+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-lodash","fixed_in":["4.17.15+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-lodash","fixed_in":["4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-lodash","fixed_in":["4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"node-lodash","fixed_in":["4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-lodash","fixed_in":["4.17.23+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.23"},{"last_affected":"4.17.23"},{"fixed":"4.18.1"}]}],"versions":["4.17.23"]},{"source":"ghsa","ecosystem":"npm","package":"lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.23"},{"last_affected":"4.17.23"},{"fixed":"4.18.1"}]}],"versions":["4.17.23"]},{"source":"ghsa","ecosystem":"npm","package":"lodash-amd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.23"},{"last_affected":"4.17.23"},{"fixed":"4.18.1"}]}],"versions":["4.17.23"]},{"source":"ghsa","ecosystem":"npm","package":"lodash.unset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"lodash.omit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.1-tuxcare.0"},{"fixed":"4.18.1-tuxcare.1"}]}],"versions":["4.18.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.21-tuxcare.0"},{"fixed":"4.17.21-tuxcare.1"}]}],"versions":["4.17.21"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.4-tuxcare.0"},{"fixed":"4.17.4-tuxcare.3"}]}],"versions":["4.17.4","4.17.4-tuxcare.1","4.17.4-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.11-tuxcare.0"},{"fixed":"4.17.11-tuxcare.2"}]}],"versions":["4.17.11","4.17.11-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.5-tuxcare.0"},{"fixed":"4.17.5-tuxcare.3"}]}],"versions":["4.17.5","4.17.5-tuxcare.1","4.17.5-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.11-tuxcare.0"},{"fixed":"4.17.11-tuxcare.1"}]}],"versions":["4.17.11"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.21-tuxcare.0"},{"fixed":"4.17.21-tuxcare.1"}]}],"versions":["4.17.21"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.15-tuxcare.0"},{"fixed":"4.17.15-tuxcare.1"}]}],"versions":["4.17.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.23-tuxcare.0"},{"fixed":"4.17.23-tuxcare.1"}]}],"versions":["4.17.23"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.clone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.clonedeepwith","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.difference","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.flatmap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.foreach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.isequal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.uniq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.uniqwith","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.xor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.1","4.5.0-tuxcare.2","4.5.0-tuxcare.3","4.5.0-tuxcare.4","4.5.0-tuxcare.5","4.5.0-tuxcare.6","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.clonedeep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.8"}]}],"versions":["4.5.0","4.5.0-tuxcare.7"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.15-tuxcare.0"},{"fixed":"4.17.15-tuxcare.11"}]}],"versions":["4.17.15","4.17.15-tuxcare.1","4.17.15-tuxcare.10","4.17.15-tuxcare.2","4.17.15-tuxcare.3","4.17.15-tuxcare.4","4.17.15-tuxcare.5","4.17.15-tuxcare.6","4.17.15-tuxcare.7","4.17.15-tuxcare.8","4.17.15-tuxcare.9"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.isequal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.10"}]}],"versions":["4.5.0","4.5.0-tuxcare.7","4.5.0-tuxcare.8","4.5.0-tuxcare.9"]},{"source":"osv","ecosystem":"Debian:12","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9"]},{"source":"osv","ecosystem":"Debian:13","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9"]},{"source":"osv","ecosystem":"Debian:14","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.1+dfsg-1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-10","4.17.21+dfsg+~cs8.31.198.20210220-9","4.17.23+dfsg-1"]},{"source":"osv","ecosystem":"npm","package":"lodash","ranges":[{"type":"SEMVER","events":[{"introduced":"4.17.23"},{"fixed":"4.18.1"}]}],"versions":["4.17.23"]},{"source":"osv","ecosystem":"npm","package":"lodash-es","ranges":[{"type":"SEMVER","events":[{"introduced":"4.17.23"},{"fixed":"4.18.1"}]}],"versions":["4.17.23"]},{"source":"osv","ecosystem":"npm","package":"lodash-amd","ranges":[{"type":"SEMVER","events":[{"introduced":"4.17.23"},{"fixed":"4.18.1"}]}],"versions":["4.17.23"]},{"source":"osv","ecosystem":"npm","package":"lodash.unset","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.18.0"}]}]},{"source":"osv","ecosystem":"npm","package":"lodash.omit","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.18.0"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"cockpit-ws-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el9_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-packagekit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-storaged","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-bridge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-system","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-ws","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"cockpit-ws-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:356.1-1.el10_2"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:11.12.1-1.25.9.0.1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs25-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:25.9.0-1.1.hum1"}]}],"bundled":21},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"yarnpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.22.22-18.1.hum1"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-full-i18n","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-npm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:10.8.2-1.20.20.2.1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"nodejs20-npm-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20.20.2-1.hum1"}]}],"bundled":14},{"source":"osv","ecosystem":"Root:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21-aikido.2"},{"fixed":"4.17.23-aikido.2"},{"fixed":"4.17.21-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.23-aikido.2"},{"fixed":"4.17.21-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21-root.io.2"},{"fixed":"4.17.21-root.io.1"},{"fixed":"4.17.23-root.io.1"},{"fixed":"4.17.23-root.io.2"},{"fixed":"4.17.21-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21-root.io.3"},{"fixed":"4.17.23-root.io.1"},{"fixed":"4.17.23-root.io.2"},{"fixed":"4.17.21-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1+dfsg-3ubuntu0.1~esm1"}]}],"versions":["2.4.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4+dfsg-1ubuntu0.1~esm1"}]}],"versions":["4.17.4+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.15+dfsg-2ubuntu0.1~esm1"}]}],"versions":["4.17.11+dfsg-4","4.17.15+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1"}]}],"versions":["4.17.21+dfsg+~cs8.31.173-1","4.17.21+dfsg+~cs8.31.196.20210220-2","4.17.21+dfsg+~cs8.31.198.20210220-4","4.17.21+dfsg+~cs8.31.198.20210220-5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.17.23+dfsg-1","4.18.1+dfsg-3","4.18.1+dfsg1-1","4.18.1+dfsg1-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.23+dfsg-1ubuntu0.1~esm1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9","4.17.23+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1+dfsg-3ubuntu0.1~esm1"}]}],"versions":["2.4.1+dfsg-3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4+dfsg-1ubuntu0.1~esm1"}]}],"versions":["4.17.4+dfsg-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.15+dfsg-2ubuntu0.1~esm1"}]}],"versions":["4.17.11+dfsg-4","4.17.15+dfsg-2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1"}]}],"versions":["4.17.21+dfsg+~cs8.31.173-1","4.17.21+dfsg+~cs8.31.196.20210220-2","4.17.21+dfsg+~cs8.31.198.20210220-4","4.17.21+dfsg+~cs8.31.198.20210220-5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.23+dfsg-1ubuntu0.1~esm1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9","4.17.23+dfsg-1"],"bundled":6}],"products":[{"vendor":"lodash","product":"lodash"},{"vendor":"lodash","product":"lodash-amd"},{"vendor":"lodash","product":"lodash-es"},{"vendor":"lodash","product":"lodash.omit"},{"vendor":"lodash","product":"lodash.unset"}],"references":[{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","tags":["advisory","web","article"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["advisory","web","article"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/commit/4f0e376589e1889e8993e212a5c9041112ad178e","tags":["web"]},{"url":"https://github.com/lodash/lodash/commit/87e6676934f7b4450fad68c35f0325ba165b48f8","tags":["web"]},{"url":"https://github.com/lodash/lodash/commit/bbcf0036d27ef936f175bf26e73e247994d8e1e4","tags":["web"]},{"url":"https://github.com/lodash/lodash/commit/db27b6bb14b12a1451b20edf87dfe307b87a337d","tags":["web"]},{"url":"https://github.com/lodash/lodash/commit/fe8d32eda854377349a4f922ab7655c8e5df9a0b","tags":["web"]},{"url":"https://github.com/lodash/lodash/releases/tag/4.18.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f23m-r3pf-42rh"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2950.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-2950","tags":["advisory"]},{"url":"https://github.com/lodash/lodash","tags":["package"]},{"url":"https://access.redhat.com/errata/RHBA-2026:21387","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_21387.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453499","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-2950","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4631","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2450246","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4631","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4631","tags":["advisory"]},{"url":"https://github.com/cockpit-project/cockpit/security/advisories/GHSA-m4gv-x78h-3427","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-4800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453496","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-4800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","tags":["advisory"]},{"url":"https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","tags":["article"]},{"url":"https://access.redhat.com/errata/RHBA-2026:21388","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhba-2026_21388.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7378","tags":["advisory"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-59464","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55132","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55131","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-55130","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45149","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9697","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6734","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9675","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9678","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48618","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48933","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48615","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48936","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48934","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48928","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48930","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48619","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-48935","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59870","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-59868","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7378.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431352","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55130","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55130","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/december-2025-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431350","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55131","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55131","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431338","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-55132","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55132","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2431344","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-59464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59464","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490024","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6734","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6734","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-hm92-r4w5-c3mj","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2489979","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9675","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-38rv-x7px-6hhq","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490000","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9678","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9678","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490018","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9697","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9697","tags":["advisory"]},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-vmh5-mc38-953g","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2483481","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45149","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45149","tags":["advisory"]},{"url":"https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-jxxr-4gwj-5jf2","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493335","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48615","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48615","tags":["advisory"]},{"url":"https://nodejs.org/en/blog/vulnerability/june-2026-security-releases","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48618","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48618","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48619","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48619","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493333","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48928","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493326","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48930","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48930","tags":["advisory"]},{"url":"https://github.com/nodejs/node/commit/7dafafa2424710ded8b77eb7c878e884c1aef64e","tags":["article"]},{"url":"https://hackerone.com/reports/3656716","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493331","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48933","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48933","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493332","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48934","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48934","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493329","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48935","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48935","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2493336","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-48936","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48936","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498114","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59868","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59868","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/3105455b81dee69e0fd36e09ac0b2ccfdb54adc1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.0","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-g796-fgmg-93mv","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498130","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59870","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59870","tags":["advisory"]},{"url":"https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/releases/tag/5.2.1","tags":["article"]},{"url":"https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:7655","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-45736","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7655.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477914","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45736","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45736","tags":["advisory"]},{"url":"https://github.com/websockets/ws/commit/c0327ec15a54d701eb6ccefaa8bef328cfc03086","tags":["article"]},{"url":"https://github.com/websockets/ws/security/advisories/GHSA-58qx-3vcg-4xpx","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:9455","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-8723","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_9455.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478227","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8723","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8723","tags":["advisory"]},{"url":"https://github.com/ljharb/qs/commit/21f80b33e5c8b3f7eba1034fff0da4a4a37a1d41","tags":["article"]},{"url":"https://github.com/ljharb/qs/security/advisories/GHSA-q8mj-m7cp-5q26","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2026-2950","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8411-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23337","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-13465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4800","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-2950","title":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","status":"published","published":"2026-03-31T19:18:35.796Z","modified":"2026-10-15T06:44:37.552Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T13:48:35.749498Z"}],"euvd":[{"id":"EUVD-2026-17591","description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","status":"published","published":"2026-03-31T19:18:35Z","modified":"2026-10-15T06:44:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T17:00:15.585288Z"}],"ghsa":[{"id":"GHSA-f23m-r3pf-42rh","title":"lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt","description":"### Impact\n\nThe `_.unset`, `_.omit`, and `_.pullAt` functions are vulnerable to prototype pollution. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\n### Patches\n\nThe issue is patched from 4.18.0 to 4.18.1 depending on the package: `lodash`, `lodash-es`, and `lodash-amd` in 4.18.1, and the standalone `lodash.unset` and `lodash.omit` packages in 4.18.0.\n\n### Workarounds\n\nNone. Upgrade to the patched version.\n\n### References\n\n- [CVE-2025-13465 / GHSA-xxjr-mmjv-4gpg](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) (original fix that this bypasses)","status":"published","published":"2026-04-01T23:50:27Z","modified":"2026-11-03T15:37:13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-03T17:59:55.458475Z"}],"nvd":[{"id":"CVE-2026-2950","description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","status":"published","published":"2026-03-31T20:16:26.207Z","modified":"2026-10-15T07:18:00.143Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"CVE-2026-2950","title":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","status":"published","published":"2026-03-31T19:18:35.796Z","modified":"2026-10-28T02:31:11.896256232Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"DEBIAN-CVE-2026-2950","description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","status":"published","published":"2026-03-31T20:16:26.207Z","modified":"2026-10-16T09:47:29.1667331Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:53.877573Z"},{"id":"GHSA-f23m-r3pf-42rh","title":"lodash vulnerable to prototype pollution via array-path bypass in `_.unset`, `_.omit`, and `_.pullAt","description":"### Impact\n\nThe `_.unset`, `_.omit`, and `_.pullAt` functions are vulnerable to prototype pollution. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\n### Patches\n\nThe issue is patched from 4.18.0 to 4.18.1 depending on the package: `lodash`, `lodash-es`, and `lodash-amd` in 4.18.1, and the standalone `lodash.unset` and `lodash.omit` packages in 4.18.0.\n\n### Workarounds\n\nNone. Upgrade to the patched version.\n\n### References\n\n- [CVE-2025-13465 / GHSA-xxjr-mmjv-4gpg](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) (original fix that this bypasses)","status":"published","published":"2026-04-01T23:50:27Z","modified":"2026-11-03T15:45:08.465610798Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-03T15:57:39.116496Z"},{"id":"RHBA-2026:21387","title":"Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update","status":"published","published":"2026-08-18T10:09:07Z","modified":"2026-10-16T10:43:09.753258131Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHBA-2026:21388","title":"Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update","status":"published","published":"2026-10-16T10:09:31Z","modified":"2026-10-16T10:30:37.083070039Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2026:7378","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-04-21T10:09:52Z","modified":"2026-10-20T10:15:20Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:7655","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-04T10:11:32Z","modified":"2026-10-20T10:15:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.928316Z"},{"id":"RHSA-2026:9455","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-05-04T10:11:51Z","modified":"2026-10-19T10:08:10Z","cvss":[{"version":"3.0","score":7.7,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"ROOT-APP-NPM-CVE-2026-2950","title":"CVE-2026-2950 in lodash - Patched by Root","description":"Root has patched CVE-2026-2950 in the lodash package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-06T06:27:23Z","modified":"2026-10-06T07:15:05.947018125Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:27.649662Z"},{"id":"UBUNTU-CVE-2026-2950","description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","status":"published","published":"2026-03-31T20:16:00Z","modified":"2026-10-28T20:17:47.809328849Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:11.640778Z"},{"id":"CLSA-2026-1777336764","title":"TuxCare security update for lodash (6 CVEs)","description":"TuxCare rebuilt lodash to address 6 CVEs. Fixed in 4.18.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:45:51.099319726Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1778633139","title":"TuxCare security update for lodash (3 CVEs)","description":"TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.21-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:30.924510689Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1784596286","title":"TuxCare security update for lodash (5 CVEs)","description":"TuxCare rebuilt lodash to address 5 CVEs. Fixed in 4.17.4-tuxcare.3.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:54.114496471Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291645","title":"TuxCare security update for lodash (2 CVEs)","description":"TuxCare rebuilt lodash to address 2 CVEs. Fixed in 4.17.11-tuxcare.2.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:47:37.377550869Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785291646","title":"TuxCare security update for lodash (4 CVEs)","description":"TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.5-tuxcare.3.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-10-15T09:48:03.822293218Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785468076","title":"TuxCare security update for lodash-es (7 CVEs)","description":"TuxCare rebuilt lodash-es to address 7 CVEs. Fixed in 4.17.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:59.090246645Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468081","title":"TuxCare security update for lodash-es (3 CVEs)","description":"TuxCare rebuilt lodash-es to address 3 CVEs. Fixed in 4.17.21-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:59.092722874Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468082","title":"TuxCare security update for lodash-es (6 CVEs)","description":"TuxCare rebuilt lodash-es to address 6 CVEs. Fixed in 4.17.15-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.182619085Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1791293623","title":"TuxCare security update for lodash (4 CVEs)","description":"TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.23-tuxcare.1.","status":"published","published":"2026-10-06T13:33:43Z","modified":"2026-10-15T09:47:39.675539064Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792102343","title":"TuxCare security update for 10 packages (1 CVE)","description":"TuxCare rebuilt 10 packages to address 1 CVE. Fixed in 4.5.0-tuxcare.8.","status":"published","published":"2026-10-15T22:12:23Z","modified":"2026-10-18T13:15:38.76541393Z","updated_at":"2026-11-02T15:43:50.949147Z"},{"id":"CLSA-2026-1792327052","title":"TuxCare security update for lodash.clonedeep (1 CVE)","description":"TuxCare rebuilt lodash.clonedeep to address 1 CVE. Fixed in 4.5.0-tuxcare.8.","status":"published","published":"2026-10-18T12:37:32Z","modified":"2026-10-18T19:15:38.089712321Z","updated_at":"2026-11-02T15:43:52.545698Z"},{"id":"CLSA-2026-1792762945","title":"TuxCare security update for lodash (1 CVE)","description":"TuxCare rebuilt lodash to address 1 CVE. Fixed in 4.17.15-tuxcare.11.","status":"published","published":"2026-10-23T13:42:25Z","modified":"2026-10-23T19:15:09.364713352Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"CLSA-2026-1792869761","title":"TuxCare security update for lodash.isequal (1 CVE)","description":"TuxCare rebuilt lodash.isequal to address 1 CVE. Fixed in 4.5.0-tuxcare.10.","status":"published","published":"2026-10-24T19:22:40Z","modified":"2026-10-25T01:30:08.315592394Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"USN-8411-1","title":"node-lodash vulnerabilities","description":"It was discovered that Lodash was vulnerable to a prototype pollution\nissue in the zipObjectDeep function. An attacker could possibly use this\nissue to modify application behavior. This issue only affected Ubuntu\n18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8203)\n\nLiyuan Chen discovered that Lodash was vulnerable to a regular\nexpression denial of service issue in the toNumber, trim, and trimEnd\nfunctions. An attacker could possibly use this issue to consume\nexcessive system resources, resulting in a denial of service. This issue\nonly affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-28500)\n\nMarc Hassan discovered that Lodash did not properly sanitize input to\nthe template function. An attacker could possibly use this issue to\ninject and execute arbitrary commands. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-23337)\n\nIt was discovered that Lodash was vulnerable to a prototype pollution\nissue in the unset and omit functions. An attacker could possibly use\nthis issue to delete properties from global prototypes, resulting in\nsecurity restrictions being bypassed. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and\nUbuntu 25.10. (CVE-2025-13465)\n\nIt was discovered that Lodash was vulnerable to a prototype pollution\nissue in the unset and omit functions. An attacker could possibly use\nthis issue to delete properties from built-in prototypes, resulting in\nsecurity restrictions being bypassed. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu\n25.10, and Ubuntu 26.04 LTS. (CVE-2026-2950)\n\nIt was discovered that Lodash did not properly validate certain inputs\nto the template function. An attacker could possibly use this issue to\ninject malicious code during template processing, resulting in arbitrary\ncode execution. (CVE-2026-4800)","status":"published","published":"2026-06-09T15:16:59Z","modified":"2026-10-27T04:17:21.778951643Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}