CVE-2025-13465

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23
References
Link Resource
https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:11414
https://access.redhat.com/errata/RHSA-2026:13542
https://access.redhat.com/errata/RHSA-2026:13548
https://access.redhat.com/errata/RHSA-2026:13829
https://access.redhat.com/errata/RHSA-2026:14774
https://access.redhat.com/errata/RHSA-2026:14870
https://access.redhat.com/errata/RHSA-2026:14871
https://access.redhat.com/errata/RHSA-2026:15091
https://access.redhat.com/errata/RHSA-2026:17469
https://access.redhat.com/errata/RHSA-2026:1845
https://access.redhat.com/errata/RHSA-2026:18480
https://access.redhat.com/errata/RHSA-2026:18868
https://access.redhat.com/errata/RHSA-2026:19712
https://access.redhat.com/errata/RHSA-2026:20042
https://access.redhat.com/errata/RHSA-2026:20088
https://access.redhat.com/errata/RHSA-2026:2078
https://access.redhat.com/errata/RHSA-2026:2119
https://access.redhat.com/errata/RHSA-2026:2145
https://access.redhat.com/errata/RHSA-2026:2147
https://access.redhat.com/errata/RHSA-2026:2148
https://access.redhat.com/errata/RHSA-2026:2149
https://access.redhat.com/errata/RHSA-2026:21658
https://access.redhat.com/errata/RHSA-2026:24331
https://access.redhat.com/errata/RHSA-2026:2438
https://access.redhat.com/errata/RHSA-2026:2452
https://access.redhat.com/errata/RHSA-2026:2462
https://access.redhat.com/errata/RHSA-2026:2465
https://access.redhat.com/errata/RHSA-2026:2469
https://access.redhat.com/errata/RHSA-2026:2484
https://access.redhat.com/errata/RHSA-2026:25089
https://access.redhat.com/errata/RHSA-2026:2651
https://access.redhat.com/errata/RHSA-2026:2661
https://access.redhat.com/errata/RHSA-2026:2672
https://access.redhat.com/errata/RHSA-2026:2675
https://access.redhat.com/errata/RHSA-2026:2694
https://access.redhat.com/errata/RHSA-2026:2816
https://access.redhat.com/errata/RHSA-2026:2817
https://access.redhat.com/errata/RHSA-2026:2818
https://access.redhat.com/errata/RHSA-2026:2819
https://access.redhat.com/errata/RHSA-2026:2900
https://access.redhat.com/errata/RHSA-2026:2926
https://access.redhat.com/errata/RHSA-2026:2984
https://access.redhat.com/errata/RHSA-2026:2990
https://access.redhat.com/errata/RHSA-2026:3087
https://access.redhat.com/errata/RHSA-2026:33154
https://access.redhat.com/errata/RHSA-2026:33371
https://access.redhat.com/errata/RHSA-2026:34100
https://access.redhat.com/errata/RHSA-2026:3422
https://access.redhat.com/errata/RHSA-2026:34608
https://access.redhat.com/errata/RHSA-2026:36651
https://access.redhat.com/errata/RHSA-2026:36882
https://access.redhat.com/errata/RHSA-2026:3710
https://access.redhat.com/errata/RHSA-2026:3782
https://access.redhat.com/errata/RHSA-2026:3825
https://access.redhat.com/errata/RHSA-2026:3869
https://access.redhat.com/errata/RHSA-2026:3870
https://access.redhat.com/errata/RHSA-2026:3874
https://access.redhat.com/errata/RHSA-2026:3884
https://access.redhat.com/errata/RHSA-2026:3958
https://access.redhat.com/errata/RHSA-2026:3960
https://access.redhat.com/errata/RHSA-2026:3962
https://access.redhat.com/errata/RHSA-2026:40118
https://access.redhat.com/errata/RHSA-2026:40945
https://access.redhat.com/errata/RHSA-2026:40984
https://access.redhat.com/errata/RHSA-2026:41064
https://access.redhat.com/errata/RHSA-2026:4423
https://access.redhat.com/errata/RHSA-2026:4466
https://access.redhat.com/errata/RHSA-2026:4467
https://access.redhat.com/errata/RHSA-2026:4630
https://access.redhat.com/errata/RHSA-2026:4782
https://access.redhat.com/errata/RHSA-2026:5633
https://access.redhat.com/errata/RHSA-2026:5636
https://access.redhat.com/errata/RHSA-2026:6192
https://access.redhat.com/errata/RHSA-2026:6288
https://access.redhat.com/errata/RHSA-2026:6497
https://access.redhat.com/errata/RHSA-2026:6567
https://access.redhat.com/errata/RHSA-2026:8218
https://access.redhat.com/errata/RHSA-2026:8229
https://access.redhat.com/errata/RHSA-2026:9848
https://access.redhat.com/security/cve/CVE-2025-13465
https://bugzilla.redhat.com/show_bug.cgi?id=2431740
https://cert-portal.siemens.com/productcert/html/ssa-253495.html
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json
Configurations

Configuration 1 (hide)

cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*

History

20 Jul 2026, 12:16

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2026:40138', 'source': '0b0ca135-0b70-47e7-9f44-1890c2a1c46c'}
  • () https://access.redhat.com/errata/RHSA-2026:41064 -

17 Jul 2026, 13:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40945 -

16 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:40118 -
  • () https://access.redhat.com/errata/RHSA-2026:40138 -
  • () https://access.redhat.com/errata/RHSA-2026:40984 -

10 Jul 2026, 12:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34100 -

09 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:36651 -
  • () https://access.redhat.com/errata/RHSA-2026:36882 -

03 Jul 2026, 13:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:34608 -

30 Jun 2026, 05:17

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:33371 -

30 Jun 2026, 03:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:11414 -
  • () https://access.redhat.com/errata/RHSA-2026:13542 -
  • () https://access.redhat.com/errata/RHSA-2026:13548 -
  • () https://access.redhat.com/errata/RHSA-2026:13829 -
  • () https://access.redhat.com/errata/RHSA-2026:14774 -
  • () https://access.redhat.com/errata/RHSA-2026:14870 -
  • () https://access.redhat.com/errata/RHSA-2026:14871 -
  • () https://access.redhat.com/errata/RHSA-2026:15091 -
  • () https://access.redhat.com/errata/RHSA-2026:17469 -
  • () https://access.redhat.com/errata/RHSA-2026:1845 -
  • () https://access.redhat.com/errata/RHSA-2026:18480 -
  • () https://access.redhat.com/errata/RHSA-2026:18868 -
  • () https://access.redhat.com/errata/RHSA-2026:19712 -
  • () https://access.redhat.com/errata/RHSA-2026:20042 -
  • () https://access.redhat.com/errata/RHSA-2026:20088 -
  • () https://access.redhat.com/errata/RHSA-2026:2078 -
  • () https://access.redhat.com/errata/RHSA-2026:2119 -
  • () https://access.redhat.com/errata/RHSA-2026:2145 -
  • () https://access.redhat.com/errata/RHSA-2026:2147 -
  • () https://access.redhat.com/errata/RHSA-2026:2148 -
  • () https://access.redhat.com/errata/RHSA-2026:2149 -
  • () https://access.redhat.com/errata/RHSA-2026:21658 -
  • () https://access.redhat.com/errata/RHSA-2026:24331 -
  • () https://access.redhat.com/errata/RHSA-2026:2438 -
  • () https://access.redhat.com/errata/RHSA-2026:2452 -
  • () https://access.redhat.com/errata/RHSA-2026:2462 -
  • () https://access.redhat.com/errata/RHSA-2026:2465 -
  • () https://access.redhat.com/errata/RHSA-2026:2469 -
  • () https://access.redhat.com/errata/RHSA-2026:2484 -
  • () https://access.redhat.com/errata/RHSA-2026:25089 -
  • () https://access.redhat.com/errata/RHSA-2026:2651 -
  • () https://access.redhat.com/errata/RHSA-2026:2661 -
  • () https://access.redhat.com/errata/RHSA-2026:2672 -
  • () https://access.redhat.com/errata/RHSA-2026:2675 -
  • () https://access.redhat.com/errata/RHSA-2026:2694 -
  • () https://access.redhat.com/errata/RHSA-2026:2816 -
  • () https://access.redhat.com/errata/RHSA-2026:2817 -
  • () https://access.redhat.com/errata/RHSA-2026:2818 -
  • () https://access.redhat.com/errata/RHSA-2026:2819 -
  • () https://access.redhat.com/errata/RHSA-2026:2900 -
  • () https://access.redhat.com/errata/RHSA-2026:2926 -
  • () https://access.redhat.com/errata/RHSA-2026:2984 -
  • () https://access.redhat.com/errata/RHSA-2026:2990 -
  • () https://access.redhat.com/errata/RHSA-2026:3087 -
  • () https://access.redhat.com/errata/RHSA-2026:33154 -
  • () https://access.redhat.com/errata/RHSA-2026:3422 -
  • () https://access.redhat.com/errata/RHSA-2026:3710 -
  • () https://access.redhat.com/errata/RHSA-2026:3782 -
  • () https://access.redhat.com/errata/RHSA-2026:3825 -
  • () https://access.redhat.com/errata/RHSA-2026:3869 -
  • () https://access.redhat.com/errata/RHSA-2026:3870 -
  • () https://access.redhat.com/errata/RHSA-2026:3874 -
  • () https://access.redhat.com/errata/RHSA-2026:3884 -
  • () https://access.redhat.com/errata/RHSA-2026:3958 -
  • () https://access.redhat.com/errata/RHSA-2026:3960 -
  • () https://access.redhat.com/errata/RHSA-2026:3962 -
  • () https://access.redhat.com/errata/RHSA-2026:4423 -
  • () https://access.redhat.com/errata/RHSA-2026:4466 -
  • () https://access.redhat.com/errata/RHSA-2026:4467 -
  • () https://access.redhat.com/errata/RHSA-2026:4630 -
  • () https://access.redhat.com/errata/RHSA-2026:4782 -
  • () https://access.redhat.com/errata/RHSA-2026:5633 -
  • () https://access.redhat.com/errata/RHSA-2026:5636 -
  • () https://access.redhat.com/errata/RHSA-2026:6192 -
  • () https://access.redhat.com/errata/RHSA-2026:6288 -
  • () https://access.redhat.com/errata/RHSA-2026:6497 -
  • () https://access.redhat.com/errata/RHSA-2026:6567 -
  • () https://access.redhat.com/errata/RHSA-2026:8218 -
  • () https://access.redhat.com/errata/RHSA-2026:8229 -
  • () https://access.redhat.com/errata/RHSA-2026:9848 -
  • () https://access.redhat.com/security/cve/CVE-2025-13465 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2431740 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json -

02 Jun 2026, 14:16

Type Values Removed Values Added
Summary
  • (es) Las versiones de Lodash 4.0.0 a 4.17.22 son vulnerables a la contaminación de prototipos en las funciones _.unset y _.omit. Un atacante puede pasar rutas manipuladas que hacen que Lodash elimine métodos de prototipos globales. El problema permite la eliminación de propiedades, pero no permite sobrescribir su comportamiento original. Este problema está parcheado en 4.17.23
References
  • () https://cert-portal.siemens.com/productcert/html/ssa-253495.html -

17 Feb 2026, 17:10

Type Values Removed Values Added
CPE cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*
References () https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg - () https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg - Vendor Advisory
First Time Lodash
Lodash lodash
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 5.3

21 Jan 2026, 20:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-01-21 20:16

Updated : 2026-07-20 12:16


NVD link : CVE-2025-13465

Mitre link : CVE-2025-13465

CVE.ORG link : CVE-2025-13465


JSON object : View

Products Affected

lodash

  • lodash
CWE
CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')