CVE-2025-13465
Prototype Pollution in Lodash _.unset and _.omit Functions
Publication date: 2026-01-21
Last updated on: 2026-02-17
Assigner: openjs
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| lodash | lodash | From 4.0.0 (inc) to 4.17.23 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-13465 is a prototype pollution vulnerability in Lodash versions 4.0.0 through 4.17.22, specifically in the _.unset and _.omit functions. An attacker can exploit this by passing specially crafted paths that cause Lodash to delete methods from global prototypes. While the vulnerability allows deletion of prototype properties, it does not allow overwriting or changing their original behavior. This issue was fixed in Lodash version 4.17.23. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to delete methods from global prototypes in Lodash, potentially disrupting application functionality that relies on those prototype methods. Although it does not allow overwriting behavior, the deletion of prototype properties can lead to unexpected application errors or instability. The vulnerability has a moderate severity with a CVSS score of 6.5, indicating it can be exploited remotely without privileges or user interaction, and it impacts integrity and availability at a low level. [1]
What immediate steps should I take to mitigate this vulnerability?
Upgrade Lodash to version 4.17.23 or later, as this version contains the patch that fixes the prototype pollution vulnerability in the _.unset and _.omit functions. If upgrading is not immediately possible, avoid using the vulnerable functions with untrusted input to reduce risk. [1]