{"id":"CVE-2025-13465","kind":"vulnerability","aliases":["CVE-2025-13465","GHSA-xxjr-mmjv-4gpg"],"related":[],"title":"Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions","description":"### Impact\n\nThe `_.unset`, `_.omit`, and `_.pullAt` functions are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\n### Patches\n\nThe issue is patched from 4.17.23 to 4.18.0 depending on the package: `lodash`, `lodash-es`, and `lodash-amd` in 4.17.23, and the standalone `lodash.unset` and `lodash.omit` packages in 4.18.0.\n\n### Workarounds\n\nNone. Upgrade to the patched version.","summary":"Lodash's _.unset, _.omit and _.pullAt functions accept crafted property paths that delete methods from global prototypes. The advisory says deletion is possible but overwriting original behavior is not.","severity":"high","cvss":8.2,"epss":0.01823,"exploited":false,"exploited_at":null,"products":[{"name":"lodash","fixed":["4.17.23"],"affected":">= 4.0.0, <= 4.17.22","ecosystem":"npm"},{"name":"lodash-amd","fixed":["4.17.23"],"affected":">= 4.0.0, <= 4.17.22","ecosystem":"npm"},{"name":"lodash-es","fixed":["4.17.23"],"affected":">= 4.0.0, < 4.17.23","ecosystem":"npm"},{"name":"lodash.omit","fixed":["4.18.0"],"affected":">= 4.0.0, < 4.18.0","ecosystem":"npm"},{"name":"lodash.unset","fixed":["4.18.0"],"affected":">= 4.0.0, < 4.18.0","ecosystem":"npm"},{"name":"lodash","fixed":["4.17.23"],"affected":">= 4.0.0, < 4.17.23","ecosystem":"vendor"}],"ecosystems":["npm","vendor"],"tags":["cwe-1321","javascript","lodash","node.js","npm","package"],"not_affected_if":["functions-unused","no-untrusted-paths"],"how_to_check":"- Run `npm ls lodash lodash-es lodash-amd lodash.omit lodash.unset` in the project to list installed versions.\n- Look for these packages in `package-lock.json`, `yarn.lock` or `pnpm-lock.yaml`, including transitive dependencies.","fix":"- `lodash`, `lodash-es`, `lodash-amd`: move to `4.17.23`\n- `lodash.unset`, `lodash.omit`: move to `4.18.0`","status":"open","published_at":"2026-01-21T20:16:05+00:00","first_seen_at":"2026-11-04T03:10:50+00:00","triaged_at":"2026-11-04T03:12:09+00:00","updated_at":"2026-11-04T03:16:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-04T03:12:09Z","model":"claude-haiku-5-5","output":{"fix":"- `lodash`, `lodash-es`, `lodash-amd`: move to `4.17.23`\n- `lodash.unset`, `lodash.omit`: move to `4.18.0`","reach":"unknown","title":"Lodash: crafted paths let attackers delete global prototype methods","impact":"medium","summary":"Lodash's _.unset, _.omit and _.pullAt functions accept crafted property paths that delete methods from global prototypes. The advisory says deletion is possible but overwriting original behavior is not.","audience":"developers","category":"package","nicknames":[],"who_cares":["npm","lodash","node.js","javascript"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Global prototype methods get deleted, breaking application behavior.","analyst_note":"","how_to_check":"- Run `npm ls lodash lodash-es lodash-amd lodash.omit lodash.unset` in the project to list installed versions.\n- Look for these packages in `package-lock.json`, `yarn.lock` or `pnpm-lock.yaml`, including transitive dependencies.","plain_action":"","needs_analyst":false,"not_affected_if":["no-untrusted-paths","functions-unused"],"who_is_affected":"Any application that passes user-controlled or untrusted paths into _.unset, _.omit or _.pullAt is exposed to prototype deletion. The advisory states no workarounds exist, so the affected packages must be upgraded. Projects that pin these functions to fixed inputs or never use these functions with external data are lower risk, but the advisory does not say which code paths are exploitable in practice.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000757,"input_tokens":4527,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-1321':34B '-13465':14A,22A '-2025':13A,21A '4.17.23':114C,130C '4.18.0':116C,139C '4gpg':19A 'accept':47B 'advisori':58B 'allow':103C 'amd':26A,128C 'attack':80C 'behavior':66B,107C 'caus':86C 'craft':48B,83C 'cve':12A,20A 'cwe':33B 'delet':52B,60B,89C,97C 'depend':117C 'es':29A,124C 'function':11A,46B,73C 'ghsa':16A 'ghsa-xxjr-mmjv-4gpg':15A 'global':55B,92C 'impact':67C 'issu':95C,110C 'javascript':35B 'lodash':1A,23A,25A,28A,32A,36B,40B,87C,121C,123C,127C 'lodash-':122C 'lodash-amd':24A,126C 'lodash-es':27A 'lodash.omit':30A,136C 'lodash.unset':31A,134C 'method':53B,90C 'mmjv':18A 'node.js':37B 'none':141C 'npm':38B 'omit':8A,43B,70C 'origin':65B,106C 'overwrit':64B,104C 'packag':39B,120C,137C 'pass':82C 'patch':108C,112C,145C 'path':50B,84C 'permit':96C 'pollut':4A,78C 'possibl':62B 'properti':49B,99C 'prototyp':3A,56B,77C,93C 'pullat':10A,45B,72C 'say':59B 'standalon':133C 'unset':7A,42B,69C 'upgrad':142C 'version':146C 'vulner':5A,75C 'workaround':140C 'xxjr':17A","nicknames":[],"mitigations":[],"who_affected":"Any application that passes user-controlled or untrusted paths into _.unset, _.omit or _.pullAt is exposed to prototype deletion. The advisory states no workarounds exist, so the affected packages must be upgraded. Projects that pin these functions to fixed inputs or never use these functions with external data are lower risk, but the advisory does not say which code paths are exploitable in practice.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["lodash","lodashamd","lodashes","lodashomit","lodashunset"],"ptokens":["amd","es","lodash","omit","unset"],"labels":["cwe1321","high","javascript","lodash","nodejs","npm","package","vendor"],"campaign_type":null,"first_public_at":"2026-01-21T19:06:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-xxjr-mmjv-4gpg","url":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","severity":"medium","published_at":"2026-01-21T23:01:22+00:00","modified_at":"2026-11-04T03:08:57+00:00","first_seen_at":"2026-11-04T03:10:50+00:00","fetched_at":"2026-11-04T03:16:03+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-13465","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","severity":null,"published_at":"2026-01-21T20:16:05+00:00","modified_at":"2026-10-15T07:17:53+00:00","first_seen_at":"2026-11-04T03:16:00+00:00","fetched_at":"2026-11-04T03:16:00+00:00","note":null}],"documents":[{"id":63384,"url":"https://api.github.com/repos/lodash/lodash/security-advisories/GHSA-xxjr-mmjv-4gpg","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":58459,"url":"https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":"2026-01-21T19:06:02+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63386,"url":"https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}