Medium 6.9Published Jan 21, 2026

CVE-2025-13465Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Updated under an hour ago (Oct 27, 2026, 9:00 AM ET)

Does this affect you?

It affects lodash and 59 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for lodash

Exploited in the last 30 days

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

CVSS: 6.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P
Weakness (CWE): CWE-1321
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: openjs
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Lodash lodash lodash:lodash (from the name)	from 4.0.0 before 4.17.23; 4.17.23 not affected	CNA record
Lodash lodash-amd lodash:amd (from the name)	from 4.0.0 before 4.17.23; 4.17.23 not affected	CNA record
Lodash lodash-es lodash:es (from the name)	from 4.0.0 before 4.17.23; 4.17.23 not affected	CNA record
Lodash lodash.unset lodash:lodash.unset (from the name)	from 4.0.0 before 4.18.0; 4.18.0 not affected	CNA record
Lodash lodash.omit lodash:lodash.omit (from the name)	from 4.0.0 before 4.18.0; 4.18.0 not affected	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V4.0	CISA ADP
Red Hat Cryostat 4 on RHEL 9 redhat:cryostat	from 4.1.0-17 not affected	CISA ADP
Red Hat HawtIO HawtIO 4.4.0 redhat:apache_camel_hawtio	4.4	CISA ADP
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 redhat:ansible_automation_platform	from 0:2.6.6-1.el9ap not affected	CISA ADP
Red Hat Red Hat Data Grid 8.6.0 redhat:jboss_data_grid	from infinispan-console not affected	CISA ADP
1–10 of 60

References

References

https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg	vendor-advisory
https://cna.openjsf.org/security-advisories.html
https://access.redhat.com/errata/RHSA-2026:11414
https://access.redhat.com/errata/RHSA-2026:13542
https://access.redhat.com/errata/RHSA-2026:13548
https://access.redhat.com/errata/RHSA-2026:13829
https://access.redhat.com/errata/RHSA-2026:14774
https://access.redhat.com/errata/RHSA-2026:14870
https://access.redhat.com/errata/RHSA-2026:14871
https://access.redhat.com/errata/RHSA-2026:15091
1–10 of 25

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.