# CVE-2025-13465: Lodash prototype pollution in _.unset and _.omit functions

Source: https://junglewise.ai/threats/cve-2025-13465-lodash-prototype-pollution-in-unset-and-omit-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-21. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2025-13465 · Severity: medium · CVSS 6.5 · Published 2026-01-21

Lodash is a widely used JavaScript utility library that helps developers manage data and perform common programming tasks. A security flaw in certain versions allows an attacker to delete important internal functions from the application's environment. This can lead to application crashes or unpredictable behavior, potentially disrupting services that rely on this library.

Technologies: [Lodash-Amd](https://junglewise.ai/threats/technologies/lodash-amd), [lodash (npm)](https://junglewise.ai/threats/technologies/lodash), [lodash-es (npm)](https://junglewise.ai/threats/technologies/lodash-es). Vendors: [Lodash](https://junglewise.ai/threats/vendors/lodash), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-13465 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13465 being exploited in the wild.

**How severe is CVE-2025-13465?** Medium severity, with a CVSS score of 6.5, published 21 January 2026.

**Which products and versions are affected?** Lodash-Amd >= 4.0.0, <= 4.17.22, 4.0.0 through 4.17.22; Lodash.Unset >= 4.0.0, <= 4.5.2, >=4.0.0; lodash (npm) >= 4.0.0, <= 4.17.22, SEMVER:introduced=0,fixed=4.18.0, SEMVER:introduced=4.0.0,fixed=4.17.23; lodash-es (npm) >= 4.0.0, <= 4.17.22, SEMVER:introduced=0,fixed=4.18.0, SEMVER:introduced=4.0.0,fixed=4.17.23.

**Is there a fix for CVE-2025-13465?** Yes. lodash (npm): upgrade to 4.17.23, 4.18.0 or later; lodash-es (npm): upgrade to 4.17.23, 4.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-13465 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-13465?** Check whether you run Lodash-Amd, Lodash.Unset, lodash (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lodash (npm): upgrade to 4.17.23, 4.18.0 or later

  ```sh
  npm install lodash@4.18.0
  ```

- lodash-es (npm): upgrade to 4.17.23, 4.18.0 or later

  ```sh
  npm install lodash-es@4.18.0
  ```


## Technical details

A prototype pollution vulnerability exists in Lodash's `_.unset` and `_.omit` functions due to improper path validation. By passing specially crafted paths (e.g., using `__proto__`), a remote attacker can trigger the deletion of properties or methods from global object prototypes. While this specific flaw does not allow for property overwriting or direct code execution, it can be used to cause a denial-of-service (DoS) condition by removing essential built-in methods. The issue is addressed in version 4.17.23 by improving path sanitization.

## Affected products

- Lodash lodash >= 4.0.0, <= 4.17.22
- Lodash lodash-es >= 4.0.0, <= 4.17.22
- Lodash lodash-amd >= 4.0.0, <= 4.17.22
- Lodash lodash.unset >= 4.0.0, <= 4.5.2

## Identifiers

- CVE-2025-13465
- GHSA-f23m-r3pf-42rh
- GHSA-xxjr-mmjv-4gpg

## Timeline

- 2026-01-21: disclosed
- 2026-01-21: advisory
- 2026-01-21: patched: Patched in version 4.17.23

## References

- [https://api.github.com/users/lukas-eu](https://api.github.com/users/lukas-eu)
- [https://github.com/lukas-eu](https://github.com/lukas-eu)
- [https://api.github.com/users/lukas-eu/gists%7B/gist_id%7D](https://api.github.com/users/lukas-eu/gists%7B/gist_id%7D)
- [https://api.github.com/users/lukas-eu/repos](https://api.github.com/users/lukas-eu/repos)
- [https://avatars.githubusercontent.com/u/62448426?v=4](https://avatars.githubusercontent.com/u/62448426?v=4)
- [https://api.github.com/users/lukas-eu/events%7B/privacy%7D](https://api.github.com/users/lukas-eu/events%7B/privacy%7D)

## Related threats

- [lodash vulnerable to Code Injection via `_.template` imports key names](https://junglewise.ai/threats/cve-2021-23337-lodash-command-injection-in-template-function)
- [Lodash code injection in _.template imports](https://junglewise.ai/threats/cve-2026-4800-lodash-code-injection-in-template-imports)
- [Lodash prototype pollution in unset and omit functions](https://junglewise.ai/threats/cve-2026-2950-lodash-prototype-pollution-in-unset-and-omit-functions)
- [lodash ReDoS in toNumber and trim functions](https://junglewise.ai/threats/cve-2020-28500-lodash-redos-in-tonumber-and-trim-functions)
- [lodash prototype pollution in property mutation functions](https://junglewise.ai/threats/cve-2020-8203-lodash-prototype-pollution-in-property-mutation-functions)