CVE-2025-13465: Lodash Prototype Pollution Vulnerability in `_.unset` and `_.omit` Functions
Summary
CVE-2025-13465: Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions. Affects lodash versions >= 4.0.0, < 4.17.23. Fixed in 4.17.23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lodash is a widely-used JavaScript utility library that provides modular methods for common programming tasks, such as manipulating arrays, objects, and strings. It is known for its performance and ease of use, making it a popular choice among developers. However, certain versions of Lodash are vulnerable to prototype pollution, which can lead to severe security implications if exploited.
Vulnerability Detail
The vulnerability in Lodash arises from the _.unset and _.omit functions, which allow an attacker to pass specially crafted paths that can delete properties from global prototypes. This can lead to unexpected behavior in applications that rely on these prototypes, potentially compromising the integrity of the application. While the vulnerability permits deletion of properties, it does not allow for overwriting their original behavior, which still poses a risk to application stability and security.
How To Fix
Latest published version: 4.18.1 as of 22 Oct 2026
npm install lodash@4.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.17.23
This is the first release that contains the fix.
npm install lodash@4.17.23Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to sanitize paths passed to the _.unset and _.omit functions, ensuring that they do not contain malicious or unexpected values.
Conclusion
The Lodash prototype pollution vulnerability (CVE-2025-13465) poses a significant risk to applications using affected versions of the library. It is crucial to update to version 4.17.23 or later to ensure the security and stability of your application. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for lodash →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, potentially leading to the alteration of properties and methods across all instances of that object.
Lodash versions 4.0.0 through 4.17.22 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply checking your package-lock.json file, you can identify if your application is affected by this vulnerability.
Failing to address this vulnerability can lead to security breaches, where attackers may exploit the prototype pollution to manipulate application behavior, potentially leading to data loss or unauthorized access.
Yes, implementing input validation to sanitize paths used in the _.unset and _.omit functions can help mitigate the risk until you can update to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for lodash.
