CVE-2025-13465
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk75th percentile - higher than 75% of all known CVEs
Summary
A vulnerability in Lodash versions 4.0.0 through 4.17.22 allows prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths that cause Lodash to delete methods from global prototypes.
Risk Assessment
The risk involves the potential deletion of critical methods from object prototypes, which can lead to unexpected application behavior, errors, or Denial of Service attacks.
Recommendation
It is recommended to immediately update Lodash to version 4.17.23 or later, which contains the fix for this vulnerability.
Other vulnerabilities in Lodash
See all- CVE-2026-4800High
Lodash versions before 4.18.0 do not properly validate key names in the options.imports option of _.template. An attacker can inject default-parameter expressions that execute arbitrary code during template compilation. Additionally, prototype pollution can lead to similar attacks.
- CVE-2026-2950Medium
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guarded against string key members, but an attacker can bypass it by using array-wrapped path segments. This allows deletion of properties from built-in prototypes like Object.prototype.
Original NVD description (English source)
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23
Vulnerability data from NVD (NIST) · CISA KEV · EPSS