{"id":"GHSA-xxjr-mmjv-4gpg","revision":"3deef757a3c44474b33f5cf3879a0007","records":[{"revision":"3deef757a3c44474b33f5cf3879a0007","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-xxjr-mmjv-4gpg","aliases":["CVE-2025-13465"],"title":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","description":"### Impact\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. \n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.  \n\n### Patches\n\nThis issue is patched on 4.17.23.","state":0,"publishedAt":"2026-01-21T23:01:22+00:00","modifiedAt":"2026-10-17T02:55:54.2296356+00:00","affected":[{"ecosystem":"npm","name":"lodash","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.17.23"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash.unset","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"last_affected","version":"4.5.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash-es","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.17.23"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash-amd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.17.23"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://github.com/lodash/lodash"],"sourceUrl":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xxjr-mmjv-4gpg","identifiers":["GHSA-xxjr-mmjv-4gpg","CVE-2025-13465"]},"retained":false,"historicalAffected":[]}],"coverage":[]}