Lodash versions prior to 4.17.23 and 4.18.0 have a prototype pollution vulnerability in the _.unset, _.omit, and _.pullAt functions. This flaw allows attackers to delete methods from global prototypes by passing crafted paths. The vulnerability permits deletion of properties but does not allow overwriting their original behavior. Patched versions are available starting from 4.17.23 and 4.18.0 depending on the package. No workarounds exist other than upgrading to the fixed versions.