Executive Summary

CVE-2025-13465 is a prototype pollution vulnerability in Lodash versions 4.0.0 through 4.17.22, specifically in the _.unset and _.omit functions. An attacker can exploit this by passing specially crafted paths that cause Lodash to delete methods from global prototypes. While the vulnerability allows deletion of prototype properties, it does not allow overwriting or changing their original behavior. This issue was fixed in Lodash version 4.17.23. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to delete methods from global prototypes in Lodash, potentially disrupting application functionality that relies on those prototype methods. Although it does not allow overwriting behavior, the deletion of prototype properties can lead to unexpected application errors or instability. The vulnerability has a moderate severity with a CVSS score of 6.5, indicating it can be exploited remotely without privileges or user interaction, and it impacts integrity and availability at a low level. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Lodash to version 4.17.23 or later, as this version contains the patch that fixes the prototype pollution vulnerability in the _.unset and _.omit functions. If upgrading is not immediately possible, avoid using the vulnerable functions with untrusted input to reduce risk. [1]

Useful 0 Not Useful 0