Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.

The version of IBM WebSphere eXtreme Scale installed on the remote host is prior to 8.6.2.2 IBM. It is, therefore, affected by multiple vulnerabilities as referenced in the 7282872 advisory.

  - Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
    (CVE-2021-23337)

  - Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation     for the variable option in _.template but did not apply the same validation to options.imports key names.
    Both paths flow into the same Function() constructor sink. When an application passes untrusted input as     options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary     code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which     enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector,     the polluted keys are copied into the imports object and passed to Function(). Patches: Users should     upgrade to version 4.18.0. Workarounds: Do not pass untrusted input as key names in options.imports. Only     use developer-controlled, static key names. (CVE-2026-4800)

  - Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and
    _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-     xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing     array-wrapped path segments. This allows deletion of properties from built-in prototypes such as     Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype     properties but does not allow overwriting their original behavior. Patches: This issue is patched in     4.18.0. Workarounds: None. Upgrade to the patched version. (CVE-2026-2950)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4663 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4663-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     July 02, 2026                               https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : node-lodash     Version        : 4.17.21+dfsg+~cs8.31.173-1+deb11u1     CVE ID         : CVE-2025-13465 CVE-2026-2950 CVE-2026-4800     Debian Bug     : 1126265

    Several vulnerabilities were discovered in node-lodash, a Node.js     module providing utility functions for common programming tasks.

    CVE-2025-13465

        Prototype pollution in the _.unset and _.omit functions. A         crafted property path could be used to delete properties from         built-in prototypes (such as Object.prototype), leading to         availability and integrity issues.

    CVE-2026-2950

        An incomplete fix for CVE-2025-13465. The initial guard only         handled string key members and the literal constructor.prototype         sequence, so it could be bypassed using array-wrapped path         segments (for example [['constructor'], ['keys']]), via         constructor static methods, or from primitive roots, again allowing         deletion of properties on shared built-in prototypes.

    CVE-2026-4800

        Code injection in the _.template function. An incomplete fix for         CVE-2021-23337: the variable option was validated but the         imports option key names were not. Untrusted input passed as         imports key names could inject default-parameter expressions that         execute arbitrary code at template compilation time via the same         Function() constructor sink.

    For Debian 11 bullseye, this problem has been fixed in version     4.17.21+dfsg+~cs8.31.173-1+deb11u1.

    We recommend that you upgrade your node-lodash packages.

    For the detailed security status of node-lodash please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-lodash

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8411-1 advisory.

    It was discovered that Lodash was vulnerable to a prototype pollution issue in the zipObjectDeep function.
    An attacker could possibly use this issue to modify application behavior. This issue only affected Ubuntu     18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8203)

    Liyuan Chen discovered that Lodash was vulnerable to a regular expression denial of service issue in the     toNumber, trim, and trimEnd functions. An attacker could possibly use this issue to consume excessive     system resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2020-28500)

    Marc Hassan discovered that Lodash did not properly sanitize input to the template function. An attacker     could possibly use this issue to inject and execute arbitrary commands. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-23337)

    It was discovered that Lodash was vulnerable to a prototype pollution issue in the unset and omit     functions. An attacker could possibly use this issue to delete properties from global prototypes,     resulting in security restrictions being bypassed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04     LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2025-13465)

    It was discovered that Lodash was vulnerable to a prototype pollution issue in the unset and omit     functions. An attacker could possibly use this issue to delete properties from built-in prototypes,     resulting in security restrictions being bypassed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04     LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-2950)

    It was discovered that Lodash did not properly validate certain inputs to the template function. An     attacker could possibly use this issue to inject malicious code during template processing, resulting in     arbitrary code execution. (CVE-2026-4800)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and
    _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-     xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing     array-wrapped path segments. This allows deletion of properties from built-in prototypes such as     Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype     properties but does not allow overwriting their original behavior. Patches: This issue is patched in     4.18.0. Workarounds: None. Upgrade to the patched version. (CVE-2026-2950)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and
    _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-
    xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing
    array-wrapped path segments. This allows deletion of properties from built-in prototypes such as
    Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype
    properties but does not allow overwriting their original behavior. Patches: This issue is patched in
    4.18.0. Workarounds: None. Upgrade to the patched version. (CVE-2026-2950)

ID	Name	Product	Family	Type	Severity
333386	IBM WebSphere eXtreme Scale 8.6.2.0 < 8.6.2.2 (7282872)	Nessus	Web Servers	Local	high
324594	Debian dla-4663 : libjs-lodash - security update	Nessus	Debian Local Security Checks	Local	high
320407	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Lodash vulnerabilities (USN-8411-1)	Nessus	Ubuntu Local Security Checks	Local	high
304822	Linux Distros Unpatched Vulnerability : CVE-2026-2950	Nessus	Misc.	Local	medium
439613	SCA: security update for lodash, lodash-amd, lodash-es, lodash.unset (GHSA-f23m-r3pf-42rh)	Tenable Cloud Security	SCA Checks	Local	medium
439613	SCA: security update for lodash, lodash-amd, lodash-es, lodash.unset (GHSA-f23m-r3pf-42rh)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-2950

medium

Tenable Plugins

high

high

high

medium

medium

medium