Lodash Prototype Pollution Vulnerability in _.unset and _.omit Functions

A prototype pollution vulnerability has been identified in Lodash versions 4.0.0 prior to 4.17.22. The issue arises in the _.unset and _.omit functions, where an attacker can exploit crafted paths to delete methods from global prototypes. While this vulnerability allows for the deletion of properties, it does not enable overwriting their original behavior.

Impact

Exploitation of this vulnerability allows for prototype pollution, where global prototype methods can be deleted, potentially leading to unexpected behavior in the application.

Remediation

Users can upgrade to Lodash version 4.17.23 or later to address this vulnerability. The same applies to Lodash-amd, Lodash-es, and lodash.unset packages.