Medium severity · published Jan 21, 2026
CVE-2025-13465
Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
5.3
CVSS
1.8%
EPSS
No
On KEV
Description
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
lodash · Lodash
4.0.0 before 4.17.23 · source: vendor, NVD
LO
lodash-amd · Lodash
4.0.0 before 4.17.23 · source: vendor
LO
lodash-es · Lodash
4.0.0 before 4.17.23 · source: vendor
LO
lodash.omit · Lodash
4.0.0 before 4.18.0 · source: vendor
LO
lodash.unset · Lodash
4.0.0 before 4.18.0 · source: vendor
CO
Cluster Observability Operator 1.4.0 · Red Hat
All versions, or not specified · source: CISA
C4
Cryostat 4 on RHEL 9 · Red Hat
All versions, or not specified · source: CISA
NO
Network Observability (NETOBSERV) 1.11.0 · Red Hat
All versions, or not specified · source: CISA
RR
RUGGEDCOM RST2428P · Siemens
before V4.0 · source: CISA
RH
Red Hat Advanced Cluster Management for Kubernetes 2.11 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Advanced Cluster Management for Kubernetes 2.12 · Red Hat
All versions, or not specified · source: CISA
RH
Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat
All versions, or not specified · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-13465
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-13465
cna.openjsf.org
https://cna.openjsf.org/security-advisories.html
Vendor Advisory
https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:11414
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:13542
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:13548
access.redhat.com
https://access.redhat.com/errata/RHSA-2026:13829
More from lodash
9.8
CVE-2026-4800
lodash vulnerable to Code Injection via `_.template` imports key names
9.1
CVE-2019-10744
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution
7.4
CVE-2020-8203
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20
7.2
CVE-2021-23337
Command Injection
6.5
CVE-2019-1010266
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption