VULNERABILITY INTELLIGENCE

CVE-2025-13465

CVSS score5.3 MEDIUM
EPSS probability1.82%
CISA KEVNot currently listed
Published2026-01-21
Last modified2026-10-15
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Weakness classification

  • ce714d77-add3-4f53-aff5-83d477b104bb: CWE-1321
  • 0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-1321

Primary references