Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4663 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4663-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     July 02, 2026                               https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : node-lodash     Version        : 4.17.21+dfsg+~cs8.31.173-1+deb11u1     CVE ID         : CVE-2025-13465 CVE-2026-2950 CVE-2026-4800     Debian Bug     : 1126265

    Several vulnerabilities were discovered in node-lodash, a Node.js     module providing utility functions for common programming tasks.

    CVE-2025-13465

        Prototype pollution in the _.unset and _.omit functions. A         crafted property path could be used to delete properties from         built-in prototypes (such as Object.prototype), leading to         availability and integrity issues.

    CVE-2026-2950

        An incomplete fix for CVE-2025-13465. The initial guard only         handled string key members and the literal constructor.prototype         sequence, so it could be bypassed using array-wrapped path         segments (for example [['constructor'], ['keys']]), via         constructor static methods, or from primitive roots, again allowing         deletion of properties on shared built-in prototypes.

    CVE-2026-4800

        Code injection in the _.template function. An incomplete fix for         CVE-2021-23337: the variable option was validated but the         imports option key names were not. Untrusted input passed as         imports key names could inject default-parameter expressions that         execute arbitrary code at template compilation time via the same         Function() constructor sink.

    For Debian 11 bullseye, this problem has been fixed in version     4.17.21+dfsg+~cs8.31.173-1+deb11u1.

    We recommend that you upgrade your node-lodash packages.

    For the detailed security status of node-lodash please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-lodash

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8411-1 advisory.

    It was discovered that Lodash was vulnerable to a prototype pollution issue in the zipObjectDeep function.
    An attacker could possibly use this issue to modify application behavior. This issue only affected Ubuntu     18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8203)

    Liyuan Chen discovered that Lodash was vulnerable to a regular expression denial of service issue in the     toNumber, trim, and trimEnd functions. An attacker could possibly use this issue to consume excessive     system resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2020-28500)

    Marc Hassan discovered that Lodash did not properly sanitize input to the template function. An attacker     could possibly use this issue to inject and execute arbitrary commands. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-23337)

    It was discovered that Lodash was vulnerable to a prototype pollution issue in the unset and omit     functions. An attacker could possibly use this issue to delete properties from global prototypes,     resulting in security restrictions being bypassed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04     LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2025-13465)

    It was discovered that Lodash was vulnerable to a prototype pollution issue in the unset and omit     functions. An attacker could possibly use this issue to delete properties from built-in prototypes,     resulting in security restrictions being bypassed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04     LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-2950)

    It was discovered that Lodash did not properly validate certain inputs to the template function. An     attacker could possibly use this issue to inject malicious code during template processing, resulting in     arbitrary code execution. (CVE-2026-4800)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and
    _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-     xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing     array-wrapped path segments. This allows deletion of properties from built-in prototypes such as     Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype     properties but does not allow overwriting their original behavior. Patches: This issue is patched in     4.18.0. Workarounds: None. Upgrade to the patched version. (CVE-2026-2950)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and
    _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-
    xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing
    array-wrapped path segments. This allows deletion of properties from built-in prototypes such as
    Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype
    properties but does not allow overwriting their original behavior. Patches: This issue is patched in
    4.18.0. Workarounds: None. Upgrade to the patched version. (CVE-2026-2950)

ID	Name	Product	Family	Severity
324594	Debian dla-4663 : libjs-lodash - security update	Nessus	Debian Local Security Checks	high
320407	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Lodash vulnerabilities (USN-8411-1)	Nessus	Ubuntu Local Security Checks	high
304822	Linux Distros Unpatched Vulnerability : CVE-2026-2950	Nessus	Misc.	medium
439613	SCA: security update for lodash, lodash-amd, lodash-es, lodash.unset (GHSA-f23m-r3pf-42rh)	Tenable Cloud Security	SCA Checks	medium
439613	SCA: security update for lodash, lodash-amd, lodash-es, lodash.unset (GHSA-f23m-r3pf-42rh)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-2950

medium

Tenable Plugins

high

high

medium

medium

medium