Lodash Prototype Pollution Vulnerability in _.unset and _.omit Functions

A prototype pollution vulnerability has been identified in Lodash versions 4.0.0 prior to 4.17.23, specifically within the _.unset and _.omit functions. This vulnerability allows an attacker to manipulate paths in a way that causes Lodash to delete properties from global prototypes, such as Object.prototype, Number.prototype, and String.prototype. While the vulnerability enables the removal of prototype properties, it does not allow for overwriting their original functionality.

Impact

Exploitation of this vulnerability allows for the deletion of properties from built-in prototypes, potentially leading to unexpected behavior in the application by removing essential methods from these prototypes.

Remediation

Users are advised to upgrade to Lodash version 4.17.23 or later. Instructions for upgrading can be found in the Lodash GitHub repository.