Riskcovery

CVE-2025-13465

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

State
Published
Severity
6.9 Medium
Published
Jan 21, 2026
Updated
Oct 15, 2026
Reserved
Nov 20, 2025

Read the record on cve.org

Description

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:Popenjs
3.18.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Hredhat-SADP

Weaknesses

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Affected Products

ProductVersions
lodashLodash
  • 4.0.0 to before 4.17.23Affected
  • 4.17.23Not affected
lodash-amdLodash
  • 4.0.0 to before 4.17.23Affected
  • 4.17.23Not affected
lodash-esLodash
  • 4.0.0 to before 4.17.23Affected
  • 4.17.23Not affected
lodash.unsetLodash
  • 4.0.0 to before 4.18.0Affected
  • 4.18.0Not affected
lodash.omitLodash
  • 4.0.0 to before 4.18.0Affected
  • 4.18.0Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.