Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

This issue is patched on 4.17.23
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4663-1 node-lodash security update
Github GHSA Github GHSA GHSA-xxjr-mmjv-4gpg Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
Ubuntu USN Ubuntu USN USN-8411-1 Lodash vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

References
Link Providers
https://access.redhat.com/errata/RHSA-2026:11414 cve-icon
https://access.redhat.com/errata/RHSA-2026:13542 cve-icon
https://access.redhat.com/errata/RHSA-2026:13548 cve-icon
https://access.redhat.com/errata/RHSA-2026:13829 cve-icon
https://access.redhat.com/errata/RHSA-2026:14774 cve-icon
https://access.redhat.com/errata/RHSA-2026:14870 cve-icon
https://access.redhat.com/errata/RHSA-2026:14871 cve-icon
https://access.redhat.com/errata/RHSA-2026:15091 cve-icon
https://access.redhat.com/errata/RHSA-2026:17469 cve-icon
https://access.redhat.com/errata/RHSA-2026:1845 cve-icon
https://access.redhat.com/errata/RHSA-2026:18480 cve-icon
https://access.redhat.com/errata/RHSA-2026:18868 cve-icon
https://access.redhat.com/errata/RHSA-2026:19712 cve-icon
https://access.redhat.com/errata/RHSA-2026:20042 cve-icon
https://access.redhat.com/errata/RHSA-2026:20088 cve-icon
https://access.redhat.com/errata/RHSA-2026:2078 cve-icon
https://access.redhat.com/errata/RHSA-2026:2119 cve-icon
https://access.redhat.com/errata/RHSA-2026:2145 cve-icon
https://access.redhat.com/errata/RHSA-2026:2147 cve-icon
https://access.redhat.com/errata/RHSA-2026:2148 cve-icon
https://access.redhat.com/errata/RHSA-2026:2149 cve-icon
https://access.redhat.com/errata/RHSA-2026:21658 cve-icon
https://access.redhat.com/errata/RHSA-2026:24331 cve-icon
https://access.redhat.com/errata/RHSA-2026:2438 cve-icon
https://access.redhat.com/errata/RHSA-2026:2452 cve-icon
https://access.redhat.com/errata/RHSA-2026:2462 cve-icon
https://access.redhat.com/errata/RHSA-2026:2465 cve-icon
https://access.redhat.com/errata/RHSA-2026:2469 cve-icon
https://access.redhat.com/errata/RHSA-2026:2484 cve-icon
https://access.redhat.com/errata/RHSA-2026:25089 cve-icon
https://access.redhat.com/errata/RHSA-2026:2651 cve-icon
https://access.redhat.com/errata/RHSA-2026:2661 cve-icon
https://access.redhat.com/errata/RHSA-2026:2672 cve-icon
https://access.redhat.com/errata/RHSA-2026:2675 cve-icon
https://access.redhat.com/errata/RHSA-2026:2694 cve-icon
https://access.redhat.com/errata/RHSA-2026:2816 cve-icon
https://access.redhat.com/errata/RHSA-2026:2817 cve-icon
https://access.redhat.com/errata/RHSA-2026:2818 cve-icon
https://access.redhat.com/errata/RHSA-2026:2819 cve-icon
https://access.redhat.com/errata/RHSA-2026:2900 cve-icon
https://access.redhat.com/errata/RHSA-2026:2926 cve-icon
https://access.redhat.com/errata/RHSA-2026:2984 cve-icon
https://access.redhat.com/errata/RHSA-2026:2990 cve-icon
https://access.redhat.com/errata/RHSA-2026:3087 cve-icon
https://access.redhat.com/errata/RHSA-2026:33154 cve-icon
https://access.redhat.com/errata/RHSA-2026:33371 cve-icon
https://access.redhat.com/errata/RHSA-2026:34100 cve-icon
https://access.redhat.com/errata/RHSA-2026:3422 cve-icon
https://access.redhat.com/errata/RHSA-2026:34608 cve-icon
https://access.redhat.com/errata/RHSA-2026:36651 cve-icon
https://access.redhat.com/errata/RHSA-2026:36882 cve-icon
https://access.redhat.com/errata/RHSA-2026:3710 cve-icon
https://access.redhat.com/errata/RHSA-2026:3782 cve-icon
https://access.redhat.com/errata/RHSA-2026:3825 cve-icon
https://access.redhat.com/errata/RHSA-2026:3869 cve-icon
https://access.redhat.com/errata/RHSA-2026:3870 cve-icon
https://access.redhat.com/errata/RHSA-2026:3874 cve-icon
https://access.redhat.com/errata/RHSA-2026:3884 cve-icon
https://access.redhat.com/errata/RHSA-2026:3958 cve-icon
https://access.redhat.com/errata/RHSA-2026:3960 cve-icon
https://access.redhat.com/errata/RHSA-2026:3962 cve-icon
https://access.redhat.com/errata/RHSA-2026:40118 cve-icon
https://access.redhat.com/errata/RHSA-2026:40945 cve-icon
https://access.redhat.com/errata/RHSA-2026:40984 cve-icon
https://access.redhat.com/errata/RHSA-2026:41064 cve-icon
https://access.redhat.com/errata/RHSA-2026:41928 cve-icon
https://access.redhat.com/errata/RHSA-2026:41941 cve-icon
https://access.redhat.com/errata/RHSA-2026:41944 cve-icon
https://access.redhat.com/errata/RHSA-2026:4423 cve-icon
https://access.redhat.com/errata/RHSA-2026:4466 cve-icon
https://access.redhat.com/errata/RHSA-2026:4467 cve-icon
https://access.redhat.com/errata/RHSA-2026:4630 cve-icon
https://access.redhat.com/errata/RHSA-2026:4782 cve-icon
https://access.redhat.com/errata/RHSA-2026:5633 cve-icon
https://access.redhat.com/errata/RHSA-2026:5636 cve-icon
https://access.redhat.com/errata/RHSA-2026:6192 cve-icon
https://access.redhat.com/errata/RHSA-2026:6288 cve-icon
https://access.redhat.com/errata/RHSA-2026:6497 cve-icon
https://access.redhat.com/errata/RHSA-2026:6567 cve-icon
https://access.redhat.com/errata/RHSA-2026:8218 cve-icon
https://access.redhat.com/errata/RHSA-2026:8229 cve-icon
https://access.redhat.com/errata/RHSA-2026:9848 cve-icon
https://access.redhat.com/security/cve/CVE-2025-13465 cve-icon
https://bugzilla.redhat.com/show_bug.cgi?id=2431740 cve-icon
https://cert-portal.siemens.com/productcert/html/ssa-253495.html cve-icon
https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-13465 cve-icon
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-13465 cve-icon
History

Tue, 02 Jun 2026 14:30:00 +0000

Type Values Removed Values Added
References

Tue, 17 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}


Tue, 27 Jan 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}

threat_severity

Important


Fri, 23 Jan 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Lodash
Lodash lodash
Vendors & Products Lodash
Lodash lodash

Wed, 21 Jan 2026 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Wed, 21 Jan 2026 19:30:00 +0000

Type Values Removed Values Added
Description Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23
Title Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
Weaknesses CWE-1321
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P'}


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: openjs

Published:

Updated: 2026-08-12T12:04:50.835Z

Reserved: 2025-11-20T02:16:12.128Z

Link: CVE-2025-13465

cve-icon Vulnrichment

Updated: 2026-06-02T12:59:53.016Z

cve-icon NVD

Status : Modified

Published: 2026-01-21T20:16:05.250

Modified: 2026-08-12T12:17:21.107

Link: CVE-2025-13465

cve-icon Redhat

Severity : Important

Publid Date: 2026-01-21T19:05:28Z

Links: CVE-2025-13465 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-01-22T10:08:23Z

Weaknesses