Lodash versions prior to 4.18.1 (and some standalone packages prior to 4.18.0) are vulnerable to prototype pollution via the _.unset, _.omit, and _.pullAt functions. An attacker can bypass previous fixes by using array-wrapped path segments to delete properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. This vulnerability allows deletion of prototype properties but does not enable overwriting their original behavior. The issue is patched in lodash 4.18.1 and related packages 4.18.0 and later.