CVE-2025-13465
Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23
| CWE | CWE-1321 |
| Vendor | lodash |
| Product | lodash |
| Published | Jan 21, 2026 |
| Last Updated | Jul 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for lodash lodash
Be the first to know when new high vulnerabilities affecting lodash lodash are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Lodash / Lodash
4.0.0 ≤ 4.17.22
Lodash-amd / Lodash-amd
4.0.0 ≤ 4.17.22
lodash-es / lodash-es
4.0.0 ≤ 4.17.22
lodash.unset / lodash.unset
4.0.0
References
github.com: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg cert-portal.siemens.com: https://cert-portal.siemens.com/productcert/html/ssa-253495.html access.redhat.com: https://access.redhat.com/security/cve/CVE-2025-13465 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2431740 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33371 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3958 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:1845 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:18480 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24331 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:18868 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4782 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:25089 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2818 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2438 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2462 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2469 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2465 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2484 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2819 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2817 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2816 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2452 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2900 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41064 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:5633 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8229 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36882 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13548 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4466 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4467 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13829 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3962 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3960 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33154 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4630 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2675 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2694 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36651 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40945 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40118 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41928 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3782 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:19712 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3870 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3422 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2990 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:15091 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:4423 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14774 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2661 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20088 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34100 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2672 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:21658 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2078 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20042 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2651 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:17469 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2119 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2984 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6192 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3869 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3874 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3884 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3710 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3825 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2145 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2147 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2148 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2149 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41941 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41944 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40984 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6497 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6567 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14870 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:14871 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:6288 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:2926 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:3087 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34608 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13542 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9848 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:5636 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:8218 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:11414
Credits
Lukas Euler Jordan Harband Michał Lipiński Ulises Gascón