{"id":"GHSA-xxjr-mmjv-4gpg","revision":"8e382c65948c446c893e1454736e9cdb","records":[{"revision":"8e382c65948c446c893e1454736e9cdb","observedAt":"2026-11-04T03:57:35.731+00:00","statement":{"source":"osv","id":"GHSA-xxjr-mmjv-4gpg","aliases":["CVE-2025-13465"],"title":"Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions","description":"### Impact\n\nThe `_.unset`, `_.omit`, and `_.pullAt` functions are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\n### Patches\n\nThe issue is patched from 4.17.23 to 4.18.0 depending on the package: `lodash`, `lodash-es`, and `lodash-amd` in 4.17.23, and the standalone `lodash.unset` and `lodash.omit` packages in 4.18.0.\n\n### Workarounds\n\nNone. Upgrade to the patched version.","state":0,"publishedAt":"2026-01-21T23:01:22+00:00","modifiedAt":"2026-11-04T03:15:10.8322384+00:00","affected":[{"ecosystem":"npm","name":"lodash","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.17.23"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash-amd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.17.23"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash-es","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.17.23"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash.omit","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.18.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash.unset","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"4.18.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40138","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:3962","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3870","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3825","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3710","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:3422","https://access.redhat.com/errata/RHSA-2026:34100","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json","https://github.com/lodash/lodash","https://cna.openjsf.org/security-advisories.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://access.redhat.com/security/cve/CVE-2025-13465","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6288","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:4782","https://access.redhat.com/errata/RHSA-2026:4630","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4423","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:2149","https://access.redhat.com/errata/RHSA-2026:2148","https://access.redhat.com/errata/RHSA-2026:2147","https://access.redhat.com/errata/RHSA-2026:2145","https://access.redhat.com/errata/RHSA-2026:2119","https://access.redhat.com/errata/RHSA-2026:2078","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:1845","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:2990","https://access.redhat.com/errata/RHSA-2026:2984","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2819","https://access.redhat.com/errata/RHSA-2026:2818","https://access.redhat.com/errata/RHSA-2026:2817","https://access.redhat.com/errata/RHSA-2026:2816","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:2675","https://access.redhat.com/errata/RHSA-2026:2672","https://access.redhat.com/errata/RHSA-2026:2661","https://access.redhat.com/errata/RHSA-2026:2651","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:2484","https://access.redhat.com/errata/RHSA-2026:2469","https://access.redhat.com/errata/RHSA-2026:2465","https://access.redhat.com/errata/RHSA-2026:2462","https://access.redhat.com/errata/RHSA-2026:2452","https://access.redhat.com/errata/RHSA-2026:2438"],"sourceUrl":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xxjr-mmjv-4gpg","identifiers":["GHSA-xxjr-mmjv-4gpg","CVE-2025-13465"]},"retained":false,"historicalAffected":[]}],"coverage":[]}