PT-2026-3846 · Lodash · Lodash

Jordan Harband + 3 · Published 2025-01-01 · Updated 2026-01-21 · CVE-2025-13465

Positive Technologies · (AI Summary)

CVSS v4.0

7.9

7.9

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Lodash versions 4.0.0 through 4.17.22

Description Lodash versions 4.0.0 through 4.17.22 are susceptible to prototype pollution within the

 .unset

and

 .omit

functions. An attacker can leverage crafted paths to trigger the deletion of methods from global prototypes. The issue allows for property deletion but does not permit modification of the original behavior of those properties.

Recommendations Update to Lodash version 4.17.23 or later.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-13465

GHSA-XXJR-MMJV-4GPG

Affected Products

Lodash

References · 10

• https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-13465 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-13465 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-13465 · Vendor Advisory
• https://github.com/lodash/lodash · Note
• https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg · Note
• https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81 · Note
• https://twitter.com/CVEnew/status/2014061171981033883 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014100070145081580 · Twitter Post
• https://twitter.com/lsof/status/2014102871369728207 · Twitter Post