Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2025-13465

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
openjs

Description

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Lodash lodash

Default version status: unaffected

  • 4.0.0 to < 4.17.23affected
  • 4.17.23unaffected
pkg:npm/lodash

Lodash lodash-amd

Default version status: unaffected

  • 4.0.0 to < 4.17.23affected
  • 4.17.23unaffected
pkg:npm/lodash-amd

Lodash lodash-es

Default version status: unaffected

  • 4.0.0 to < 4.17.23affected
  • 4.17.23unaffected
pkg:npm/lodash-es

Lodash lodash.unset

Default version status: unaffected

  • 4.0.0 to < 4.18.0affected
  • 4.18.0unaffected
pkg:npm/lodash.unset

Lodash lodash.omit

Default version status: unaffected

  • 4.0.0 to < 4.18.0affected
  • 4.18.0unaffected
pkg:npm/lodash.omit

References