GitStock

lodash/lodash · Security

Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions

Open GitHub
GHSA ID
GHSA-xxjr-mmjv-4gpg
CVE ID
CVE-2025-13465
Severity
medium
Published
Updated
CVSS
6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v3
6.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
CVSS v4
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P

Description

Impact

The _.unset, _.omit, and _.pullAt functions are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

Patches

The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Workarounds

None. Upgrade to the patched version.

CWEs

  • CWE-1321 · Improperly Controlled Modification of Object Prototype Attributes

References