CVE-2025-13465: Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Impact
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the .unset and .omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
The issue permits deletion of properties but does not allow overwriting their original behavior.
Patches
This issue is patched on 4.17.23.
Other sources
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the .unset and .omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13465?
CVE-2025-13465 is considered a medium severity vulnerability.
How do I fix CVE-2025-13465?
To fix CVE-2025-13465, upgrade Lodash to a version greater than 4.17.22.
What functionality is impacted by CVE-2025-13465 in Lodash?
CVE-2025-13465 impacts the _.unset and _.omit functions in Lodash.
What can an attacker do with CVE-2025-13465?
An attacker can use CVE-2025-13465 to delete methods from global prototypes by exploiting crafted paths.
Which versions of Lodash are affected by CVE-2025-13465?
Lodash versions from 4.0.0 to 4.17.22 are affected by CVE-2025-13465.