VulnerabilityModified

CVE-2025-13465

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions.

MEDIUM 6.9EPSS 1.63%

Does this matter?

Lower severity and a low EPSS score (1.63%). Track it; it rarely justifies an emergency change on its own.

Description

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 1.63% probability · 75th percentile
CISA KEV: Not listed
Weakness: CWE-1321
Affected: lodash/lodash
Source: ce714d77-add3-4f53-aff5-83d477b104bb

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.