Live › vulnerability › CVE-2025-13465
Lodash's _.unset, _.omit and _.pullAt functions accept crafted property paths that delete methods from global prototypes. The advisory says deletion is possible but overwriting original behavior is not.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 03:10 UTC, 0h before NVD. All times on this page are UTC.
Any application that passes user-controlled or untrusted paths into _.unset, _.omit or _.pullAt is exposed to prototype deletion. The advisory states no workarounds exist, so the affected packages must be upgraded. Projects that pin these functions to fixed inputs or never use these functions with external data are lower risk, but the advisory does not say which code paths are exploitable in practice.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| lodash | npm | >= 4.0.0, <= 4.17.22 | 4.17.23 |
| lodash-amd | npm | >= 4.0.0, <= 4.17.22 | 4.17.23 |
| lodash-es | npm | >= 4.0.0, < 4.17.23 | 4.17.23 |
| lodash.omit | npm | >= 4.0.0, < 4.18.0 | 4.18.0 |
| lodash.unset | npm | >= 4.0.0, < 4.18.0 | 4.18.0 |
| lodash | vendor | >= 4.0.0, < 4.17.23 | 4.17.23 |
npm ls lodash lodash-es lodash-amd lodash.omit lodash.unset in the project to list installed versions.package-lock.json, yarn.lock or pnpm-lock.yaml, including transitive dependencies.lodash, lodash-es, lodash-amd: move to 4.17.23lodash.unset, lodash.omit: move to 4.18.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The _.unset, _.omit, and _.pullAt functions are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
The issue permits deletion of properties but does not allow overwriting their original behavior.
The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
None. Upgrade to the patched version.
This page as .md · .json · in your agent: get_signal("CVE-2025-13465")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.