Log in Start free

Vulnerability · Published Jan 21, 2026 · Assigned by openjs

CVE-2025-13465Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

High 8.2

In plain English

A high-severity prototype pollution in lodash from Lodash. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High
Exploit odds (30 days)1.8%top 21.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10cockpit-ha-cluster0.12.1-1.el10_1.2ALSA-2026:2438
AlmaLinux:9pcs0.11.10-1.el9_7.2ALSA-2026:2452
AlmaLinux:9pcs-snmp0.11.10-1.el9_7.2ALSA-2026:2452
AlmaLinux:10sgx-common2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-common2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-libs2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-libs2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-mpa2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-mpa2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-pccs2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-pccs2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-pccs-admin2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-pccs-admin2.26-7.el9ALSA-2026:18868
AlmaLinux:10sgx-pckid-tool2.26-7.el10ALSA-2026:18480
AlmaLinux:9sgx-pckid-tool2.26-7.el9ALSA-2026:18868
AlmaLinux:10tdx-qgs2.26-7.el10ALSA-2026:18480
AlmaLinux:9tdx-qgs2.26-7.el9ALSA-2026:18868
Debian:12node-lodash4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1DEBIAN-CVE-2025-13465
Debian:13node-lodash4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1DEBIAN-CVE-2025-13465
Debian:14node-lodash4.17.21+dfsg+~cs8.31.198.20210220-10DEBIAN-CVE-2025-13465
Rocky Linux:10cockpit-image-builder0:94.3-1.el10_2RLSA-2026:24331
Rocky Linux:10linux-sgx0:2.26-7.el10RLSA-2026:18480
Rocky Linux:9linux-sgx0:2.26-7.el9RLSA-2026:18868
Rocky Linux:9pcs0:0.11.10-1.el9_7.2RLSA-2026:2452
Ubuntu:25.10node-lodash4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1USN-8411-1
Ubuntu:25.10node-lodash4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1UBUNTU-CVE-2025-13465
npmlodash4.17.23GHSA-xxjr-mmjv-4gpg
npmlodash-amd4.17.23GHSA-xxjr-mmjv-4gpg
npmlodash-es4.17.23GHSA-xxjr-mmjv-4gpg
npmlodash.omit4.18.0GHSA-xxjr-mmjv-4gpg
npmlodash.unset4.18.0GHSA-xxjr-mmjv-4gpg

Affected products (as reported)

VendorProductVersions
Lodash lodash 4.0.0 – before 4.17.23
Lodash lodash-amd 4.0.0 – before 4.17.23
Lodash lodash-es 4.0.0 – before 4.17.23
Lodash lodash.unset 4.0.0 – before 4.18.0
Lodash lodash.omit 4.0.0 – before 4.18.0

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

References