Is CVE-2025-13465 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-13465 being exploited in the wild.

How severe is CVE-2025-13465?

Medium severity, with a CVSS score of 6.5, published 21 January 2026.

Which products and versions are affected?

Lodash-Amd >= 4.0.0, = 4.0.0, =4.0.0; lodash (npm) >= 4.0.0, = 4.0.0, <= 4.17.22, SEMVER:introduced=0,fixed=4.18.0, SEMVER:introduced=4.0.0,fixed=4.17.23.

Is there a fix for CVE-2025-13465?

Yes. lodash (npm): upgrade to 4.17.23, 4.18.0 or later; lodash-es (npm): upgrade to 4.17.23, 4.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-13465 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-13465?

Check whether you run Lodash-Amd, Lodash.Unset, lodash (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13465: Lodash prototype pollution in _.unset and _.omit functions

Q: Is there a fix for CVE-2025-13465?

Yes. lodash (npm): upgrade to 4.17.23, 4.18.0 or later; lodash-es (npm): upgrade to 4.17.23, 4.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-13465 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-13465?

Check whether you run Lodash-Amd, Lodash.Unset, lodash (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-13465 · Severity: medium · CVSS 6.5 · Published 2026-01-21

Lodash is a widely used JavaScript utility library that helps developers manage data and perform common programming tasks. A security flaw in certain versions allows an attacker to delete important internal functions from the application's environment. This can lead to application crashes or unpredictable behavior, potentially disrupting services that rely on this library.

Technologies: Lodash-Amd, lodash (npm), lodash-es (npm). Vendors: Lodash, npm.

Quick answers

Is CVE-2025-13465 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-13465 being exploited in the wild.
How severe is CVE-2025-13465?: Medium severity, with a CVSS score of 6.5, published 21 January 2026.
Which products and versions are affected?: Lodash-Amd >= 4.0.0, <= 4.17.22, 4.0.0 through 4.17.22; Lodash.Unset >= 4.0.0, <= 4.5.2, >=4.0.0; lodash (npm) >= 4.0.0, <= 4.17.22, SEMVER:introduced=0,fixed=4.18.0, SEMVER:introduced=4.0.0,fixed=4.17.23; lodash-es (npm) >= 4.0.0, <= 4.17.22, SEMVER:introduced=0,fixed=4.18.0, SEMVER:introduced=4.0.0,fixed=4.17.23.
Is there a fix for CVE-2025-13465?: Yes. lodash (npm): upgrade to 4.17.23, 4.18.0 or later; lodash-es (npm): upgrade to 4.17.23, 4.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-13465 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-13465?: Check whether you run Lodash-Amd, Lodash.Unset, lodash (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lodash (npm): upgrade to 4.17.23, 4.18.0 or later
```
npm install lodash@4.18.0
```
lodash-es (npm): upgrade to 4.17.23, 4.18.0 or later
```
npm install lodash-es@4.18.0
```

Technical details

A prototype pollution vulnerability exists in Lodash's `_.unset` and `_.omit` functions due to improper path validation. By passing specially crafted paths (e.g., using `__proto__`), a remote attacker can trigger the deletion of properties or methods from global object prototypes. While this specific flaw does not allow for property overwriting or direct code execution, it can be used to cause a denial-of-service (DoS) condition by removing essential built-in methods. The issue is addressed in version 4.17.23 by improving path sanitization.

Affected products

Lodash lodash >= 4.0.0, <= 4.17.22
Lodash lodash-es >= 4.0.0, <= 4.17.22
Lodash lodash-amd >= 4.0.0, <= 4.17.22
Lodash lodash.unset >= 4.0.0, <= 4.5.2

Identifiers

CVE-2025-13465
GHSA-f23m-r3pf-42rh
GHSA-xxjr-mmjv-4gpg

Timeline

2026-01-21: disclosed
2026-01-21: advisory
2026-01-21: patched: Patched in version 4.17.23

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.