---
id: "CVE-2025-13465"
kind: "vulnerability"
aliases: ["CVE-2025-13465", "GHSA-xxjr-mmjv-4gpg"]
title: "Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions"
severity: "high"
cvss: 8.2
epss: 0.01823
exploited: false
status: "open"
category: "package"
products: [{"name": "lodash", "fixed": ["4.17.23"], "affected": ">= 4.0.0, <= 4.17.22", "ecosystem": "npm"}, {"name": "lodash-amd", "fixed": ["4.17.23"], "affected": ">= 4.0.0, <= 4.17.22", "ecosystem": "npm"}, {"name": "lodash-es", "fixed": ["4.17.23"], "affected": ">= 4.0.0, < 4.17.23", "ecosystem": "npm"}, {"name": "lodash.omit", "fixed": ["4.18.0"], "affected": ">= 4.0.0, < 4.18.0", "ecosystem": "npm"}, {"name": "lodash.unset", "fixed": ["4.18.0"], "affected": ">= 4.0.0, < 4.18.0", "ecosystem": "npm"}, {"name": "lodash", "fixed": ["4.17.23"], "affected": ">= 4.0.0, < 4.17.23", "ecosystem": "vendor"}]
ecosystems: ["npm", "vendor"]
tags: ["cwe-1321", "javascript", "lodash", "node.js", "npm", "package"]
not_affected_if: ["functions-unused", "no-untrusted-paths"]
published_at: "2026-01-21T20:16:05+00:00"
first_seen_at: "2026-11-04T03:10:50+00:00"
updated_at: "2026-11-04T03:16:00+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-xxjr-mmjv-4gpg", "first_seen_at": "2026-11-04T03:10:50+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465", "first_seen_at": "2026-11-04T03:16:00+00:00"}]
---

# Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions

Lodash's _.unset, _.omit and _.pullAt functions accept crafted property paths that delete methods from global prototypes. The advisory says deletion is possible but overwriting original behavior is not.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:lodash affected >= 4.0.0, <= 4.17.22 fixed 4.17.23
- npm:lodash-amd affected >= 4.0.0, <= 4.17.22 fixed 4.17.23
- npm:lodash-es affected >= 4.0.0, < 4.17.23 fixed 4.17.23
- npm:lodash.omit affected >= 4.0.0, < 4.18.0 fixed 4.18.0
- npm:lodash.unset affected >= 4.0.0, < 4.18.0 fixed 4.18.0
- vendor:lodash affected >= 4.0.0, < 4.17.23 fixed 4.17.23

## How to check

- Run `npm ls lodash lodash-es lodash-amd lodash.omit lodash.unset` in the project to list installed versions.
- Look for these packages in `package-lock.json`, `yarn.lock` or `pnpm-lock.yaml`, including transitive dependencies.

## Fix

- `lodash`, `lodash-es`, `lodash-amd`: move to `4.17.23`
- `lodash.unset`, `lodash.omit`: move to `4.18.0`

## Timeline

- 2026-11-04T03:10:50+00:00 ghsa https://github.com/advisories/GHSA-xxjr-mmjv-4gpg
- 2026-11-04T03:16:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-13465

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/lodash/lodash/security-advisories/GHSA-xxjr-mmjv-4gpg
- [advisory] Maintainer's advisory: github.com https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
- [fix] Patch: github.com https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81

## From the sources

### Impact

The `_.unset`, `_.omit`, and `_.pullAt` functions are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

### Patches

The issue is patched from 4.17.23 to 4.18.0 depending on the package: `lodash`, `lodash-es`, and `lodash-amd` in 4.17.23, and the standalone `lodash.unset` and `lodash.omit` packages in 4.18.0.

### Workarounds

None. Upgrade to the patched version.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_