漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Vulnerability Description
Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Vulnerability Type
CWE-1321
Vulnerability Title
lodash 安全漏洞
Vulnerability Description
lodash是Lodash Utilities开源的一个JavaScript实用程序库。 lodash 4.17.23及之前版本存在安全漏洞，该漏洞源于_.unset和_.omit函数存在原型污染，可能导致删除内置原型的属性。
CVSS Information
N/A
Vulnerability Type
N/A