CVE-2025-13465 — Vulnerability in lodash — CVE Details

MEDIUM

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

Published January 21, 2026Updated September 10, 2026Source: osv

What Should I Do?

Address in Next Maintenance Window

Low exploitation probability (0.03%). Schedule for your next planned update.

Summary

### Impact Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. ### Patches This issue is patched on 4.17.23.

Advisory Timeline

First published January 21, 2026 (263 days ago).
Last revised September 10, 2026 — 231 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

npm

Update lodash to 4.17.23 or later

npm install lodash@4.17.23

npm

Update lodash-es to 4.17.23 or later

npm install lodash-es@4.17.23

npm

Update lodash-amd to 4.17.23 or later

npm install lodash-amd@4.17.23

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (4)

Affects 1 ecosystem: npm (4).

Package	Ecosystem	Affected	Fixed In
lodash	npm	All versions	4.17.23
lodash.unset	npm	All versions	Range-based data available
lodash-es	npm	All versions	4.17.23
lodash-amd	npm	All versions	4.17.23

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-1321
Prototype PollutionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

References

Frequently Asked Questions

What is CVE-2025-13465?: Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2025-13465?: CVE-2025-13465 affects lodash, lodash.unset and lodash-es (and 1 more). It has a 0.03% probability of exploitation within 30 days (EPSS score). Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-13465 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

EPSS Score (30-day exploit probability)

0.03%

Higher than 7% of vulnerabilities

This is a below-median EPSS score — only 6.8% of tracked vulnerabilities score at or below it, so most tracked vulnerabilities are considered more likely to be exploited than this one.

Also Known As

GHSA-xxjr-mmjv-4gpg

CVE-2026-2950

GHSA-f23m-r3pf-42rh

Related CVEs

CVE-2019-10744
CRITICAL
Prototype Pollution in lodash
CVE-2021-23337
HIGH
Command Injection in lodash
CVE-2020-8203
HIGH
Prototype Pollution in lodash
CVE-2021-23337
HIGH
lodash vulnerable to Code Injection via `_.template` imports key names
CVE-2020-28500
MEDIUM
Regular Expression Denial of Service (ReDoS) in lodash
CVE-2026-100723
MEDIUM
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
CVE-2026-105848
MEDIUM
Payload: Insufficient Access Control in Stripe REST Proxy
CVE-2019-1010266
MEDIUM
Regular Expression Denial of Service (ReDoS) in lodash

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies