VulnerabilityModified

CVE-2025-13465

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.

MEDIUM 6.9EPSS 1.82%

Does this matter?

Lower severity and a low EPSS score (1.82%). Track it; it rarely justifies an emergency change on its own.

Description

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 1.82% probability · 79th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-1321
Affected: lodash/lodash
Source: ce714d77-add3-4f53-aff5-83d477b104bb

EPSS trend

EPSS 1.8% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.