CVE-2025-13465

Modified Modified - Updated After Analysis

Prototype Pollution in Lodash _.unset and _.omit Functions

Publication date: 2026-01-21

Last updated on: 2026-07-03

Assigner: openjs

Description

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-21

Last Modified

2026-07-03

Generated

2026-07-06

AI Q&A

2026-01-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13465

EUVD

EUVD-2025-206319

Affected Vendors & Products

Vendor	Product	Version / Range
lodash	lodash	From 4.0.0 (inc) to 4.17.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

CVE-2025-13465 is a prototype pollution vulnerability in Lodash versions 4.0.0 through 4.17.22, specifically in the _.unset and _.omit functions. An attacker can exploit this by passing specially crafted paths that cause Lodash to delete methods from global prototypes. While the vulnerability allows deletion of prototype properties, it does not allow overwriting or changing their original behavior. This issue was fixed in Lodash version 4.17.23. [1]

Impact Analysis

This vulnerability can impact you by allowing an attacker to delete methods from global prototypes in Lodash, potentially disrupting application functionality that relies on those prototype methods. Although it does not allow overwriting behavior, the deletion of prototype properties can lead to unexpected application errors or instability. The vulnerability has a moderate severity with a CVSS score of 6.5, indicating it can be exploited remotely without privileges or user interaction, and it impacts integrity and availability at a low level. [1]

Mitigation Strategies

Upgrade Lodash to version 4.17.23 or later, as this version contains the patch that fixes the prototype pollution vulnerability in the _.unset and _.omit functions. If upgrading is not immediately possible, avoid using the vulnerable functions with untrusted input to reduce risk. [1]

Hi! I’m here to help you understand CVE-2025-13465. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70