CVE-2025-13465

5.3Medium

Published 21 Jan 2026 · NVD status: Modified · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-1321

Impact

Remote unauthenticated attackers can delete properties or methods from global JavaScript prototypes by supplying malicious object paths. This can break application logic or trigger unexpected behavior without letting them overwrite values with arbitrary data.

Root cause

Improper path sanitization in _.unset and _.omit allows target keys to resolve to and delete properties on Object.prototype.

Affected systems

lodash, lodash-es, and lodash-amd prior to 4.17.23; standalone lodash.unset and lodash.omit prior to 4.18.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Fix & remediation

Upgrade lodash, lodash-es, and lodash-amd to 4.17.23 or later, and standalone lodash.unset / lodash.omit to 4.18.0 or later. If upgrading is delayed, sanitize user-supplied object paths to block prototype properties like '__proto__', 'constructor', and 'prototype'.

shell

$ npm audit fix || npm install lodash@^4.17.23

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2025-13465