CVE record
CVE-2025-13465
Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23
CVE evidence
Known exploitation
Not listed in fetched KEV catalog
Absence from the fetched catalog does not establish that exploitation has not occurred.
Severity
moderate
CVSS 6.9 · CVSS_V4
Affected packages
4
Supported package records returned by OSV. Vendor and product names are not used to infer matches.
OSV package mapping
Affected open-source packages
| Package | Ecosystem | Fixed versions |
|---|---|---|
| lodash | npm | 4.18.0, 4.17.23 |
| lodash-es | npm | 4.18.0, 4.17.23 |
| lodash-amd | npm | 4.18.0, 4.17.23 |
| lodash.unset | npm | 4.18.0 |