{"id":"CVE-2025-13465","revision":"492d8f384c7c4c0fb215f9f4faade8ca","records":[{"revision":"492d8f384c7c4c0fb215f9f4faade8ca","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-13465","aliases":[],"title":"Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions","description":"The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.","state":0,"publishedAt":"2026-01-21T19:05:28.846+00:00","modifiedAt":"2026-10-15T06:28:33.84+00:00","affected":[{"ecosystem":"Vendor product","name":"lodash","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Lodash\",\n                    \"product\": \"lodash\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.0\",\n                            \"lessThan\": \"4.17.23\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"4.17.23\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/lodash\"\n                }"},{"ecosystem":"Vendor product","name":"lodash-amd","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Lodash\",\n                    \"product\": \"lodash-amd\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.0\",\n                            \"lessThan\": \"4.17.23\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"4.17.23\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/lodash-amd\"\n                }"},{"ecosystem":"Vendor product","name":"lodash-es","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Lodash\",\n                    \"product\": \"lodash-es\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.0\",\n                            \"lessThan\": \"4.17.23\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"4.17.23\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/lodash-es\"\n                }"},{"ecosystem":"Vendor product","name":"lodash.unset","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Lodash\",\n                    \"product\": \"lodash.unset\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.0\",\n                            \"lessThan\": \"4.18.0\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"4.18.0\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/lodash.unset\"\n                }"},{"ecosystem":"Vendor product","name":"lodash.omit","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Lodash\",\n                    \"product\": \"lodash.omit\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"4.0.0\",\n                            \"lessThan\": \"4.18.0\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"4.18.0\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/lodash.omit\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-13465","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-13465","identifiers":["CVE-2025-13465"]},"retained":false,"historicalAffected":[]}],"coverage":[]}