Skip to content
Heist/ feed
Back to feed
Medium

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Type: advisorySources: OSV

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-13465
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 03:05 UTC · Revision 1

Source evidence

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

core-osv · Original source

Published 21 Jan 2026, 19:05 UTC

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

osv:CVE-2025-13465
Complete source record
{
  "id": "77e37d27cbbe69cbb71dc9319e5bcea335a2809d0ab3558b47dbd384a504f31c",
  "url": "https://osv.dev/vulnerability/CVE-2025-13465",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions",
    "summary": "The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.",
    "evidence": "osv:CVE-2025-13465",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-13465",
      "aliases": [
        "CVE-2025-13465",
        "GHSA-xxjr-mmjv-4gpg"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/lodash/lodash",
              "type": "GIT",
              "events": [
                {
                  "introduced": "d35a9c40beb594d09814ba7f7673b81d4d67a816"
                },
                {
                  "fixed": "835a537f36ee2fd5fb7f524e213ff9ba2d8698f8"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*",
                    "range": [
                      {
                        "introduced": "4.0.0"
                      },
                      {
                        "fixed": "4.17.23"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-13465.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:53.331092978Z",
      "provider": "osv",
      "references": [
        "https://cert-portal.siemens.com/productcert/html/ssa-253495.html",
        "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json",
        "https://access.redhat.com/errata/RHSA-2026:11414",
        "https://access.redhat.com/errata/RHSA-2026:13542",
        "https://access.redhat.com/errata/RHSA-2026:13548",
        "https://access.redhat.com/errata/RHSA-2026:13829",
        "https://access.redhat.com/errata/RHSA-2026:14774",
        "https://access.redhat.com/errata/RHSA-2026:14870",
        "https://access.redhat.com/errata/RHSA-2026:14871",
        "https://access.redhat.com/errata/RHSA-2026:15091",
        "https://access.redhat.com/errata/RHSA-2026:17469",
        "https://access.redhat.com/errata/RHSA-2026:1845",
        "https://access.redhat.com/errata/RHSA-2026:18480",
        "https://access.redhat.com/errata/RHSA-2026:18868",
        "https://access.redhat.com/errata/RHSA-2026:19712",
        "https://access.redhat.com/errata/RHSA-2026:20042",
        "https://access.redhat.com/errata/RHSA-2026:20088",
        "https://access.redhat.com/errata/RHSA-2026:2078",
        "https://access.redhat.com/errata/RHSA-2026:2119",
        "https://access.redhat.com/errata/RHSA-2026:2145",
        "https://access.redhat.com/errata/RHSA-2026:2147",
        "https://access.redhat.com/errata/RHSA-2026:2148",
        "https://access.redhat.com/errata/RHSA-2026:2149",
        "https://access.redhat.com/errata/RHSA-2026:21658",
        "https://access.redhat.com/errata/RHSA-2026:24331",
        "https://access.redhat.com/errata/RHSA-2026:2438",
        "https://access.redhat.com/errata/RHSA-2026:2452",
        "https://access.redhat.com/errata/RHSA-2026:2462",
        "https://access.redhat.com/errata/RHSA-2026:2465",
        "https://access.redhat.com/errata/RHSA-2026:2469",
        "https://access.redhat.com/errata/RHSA-2026:2484",
        "https://access.redhat.com/errata/RHSA-2026:25089",
        "https://access.redhat.com/errata/RHSA-2026:2651",
        "https://access.redhat.com/errata/RHSA-2026:2661",
        "https://access.redhat.com/errata/RHSA-2026:2672",
        "https://access.redhat.com/errata/RHSA-2026:2675",
        "https://access.redhat.com/errata/RHSA-2026:2694",
        "https://access.redhat.com/errata/RHSA-2026:2816",
        "https://access.redhat.com/errata/RHSA-2026:2817",
        "https://access.redhat.com/errata/RHSA-2026:2818",
        "https://access.redhat.com/errata/RHSA-2026:2819",
        "https://access.redhat.com/errata/RHSA-2026:2900",
        "https://access.redhat.com/errata/RHSA-2026:2926",
        "https://access.redhat.com/errata/RHSA-2026:2984",
        "https://access.redhat.com/errata/RHSA-2026:2990",
        "https://access.redhat.com/errata/RHSA-2026:3087",
        "https://access.redhat.com/errata/RHSA-2026:33154",
        "https://access.redhat.com/errata/RHSA-2026:33371",
        "https://access.redhat.com/errata/RHSA-2026:34100",
        "https://access.redhat.com/errata/RHSA-2026:3422",
        "https://access.redhat.com/errata/RHSA-2026:34608",
        "https://access.redhat.com/errata/RHSA-2026:36651",
        "https://access.redhat.com/errata/RHSA-2026:36882",
        "https://access.redhat.com/errata/RHSA-2026:3710",
        "https://access.redhat.com/errata/RHSA-2026:3782",
        "https://access.redhat.com/errata/RHSA-2026:3825",
        "https://access.redhat.com/errata/RHSA-2026:3869",
        "https://access.redhat.com/errata/RHSA-2026:3870",
        "https://access.redhat.com/errata/RHSA-2026:3874",
        "https://access.redhat.com/errata/RHSA-2026:3884",
        "https://access.redhat.com/errata/RHSA-2026:3958",
        "https://access.redhat.com/errata/RHSA-2026:3960",
        "https://access.redhat.com/errata/RHSA-2026:3962",
        "https://access.redhat.com/errata/RHSA-2026:40118",
        "https://access.redhat.com/errata/RHSA-2026:40945",
        "https://access.redhat.com/errata/RHSA-2026:40984",
        "https://access.redhat.com/errata/RHSA-2026:41064",
        "https://access.redhat.com/errata/RHSA-2026:41928",
        "https://access.redhat.com/errata/RHSA-2026:41941",
        "https://access.redhat.com/errata/RHSA-2026:41944",
        "https://access.redhat.com/errata/RHSA-2026:4423",
        "https://access.redhat.com/errata/RHSA-2026:4466",
        "https://access.redhat.com/errata/RHSA-2026:4467",
        "https://access.redhat.com/errata/RHSA-2026:4630",
        "https://access.redhat.com/errata/RHSA-2026:4782",
        "https://access.redhat.com/errata/RHSA-2026:5633",
        "https://access.redhat.com/errata/RHSA-2026:5636",
        "https://access.redhat.com/errata/RHSA-2026:57487",
        "https://access.redhat.com/errata/RHSA-2026:6192",
        "https://access.redhat.com/errata/RHSA-2026:6288",
        "https://access.redhat.com/errata/RHSA-2026:6497",
        "https://access.redhat.com/errata/RHSA-2026:6567",
        "https://access.redhat.com/errata/RHSA-2026:8218",
        "https://access.redhat.com/errata/RHSA-2026:8229",
        "https://access.redhat.com/errata/RHSA-2026:9848",
        "https://access.redhat.com/security/cve/CVE-2025-13465",
        "https://cna.openjsf.org/security-advisories.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13465.json",
        "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-13465",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2431740"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-1321"
        ],
        "cna_assigner": "openjs",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13465.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-13465",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 522061,
  "published_at": "2026-01-21T19:05:28.846+00:00"
}