~ / search / GHSA-xxjr-mmjv-4gpg

GHSA-xxjr-mmjv-4gpg

Lodash has Prototype Pollution Vulnerability in `_.unset`, `_.omit`, and `_.pullAt` functions

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-13465

Packages

EcosystemPackageAffectedFixed in
npm lodash >= 4.0.0, < 4.17.23 4.17.23
npm lodash-amd >= 4.0.0, < 4.17.23 4.17.23
npm lodash-es >= 4.0.0, < 4.17.23 4.17.23
npm lodash.omit >= 4.0.0, < 4.18.0 4.18.0
npm lodash.unset >= 4.0.0, < 4.18.0 4.18.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The `_.unset`, `_.omit`, and `_.pullAt` functions are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. ### Patches The issue is patched from 4.17.23 to 4.18.0 depending on the package: `lodash`, `lodash-es`, and `lodash-amd` in 4.17.23, and the standalone `lodash.unset` and `lodash.omit` packages in 4.18.0. ### Workarounds None. Upgrade to the patched version.

References

External links from the advisory. They lead to third-party sites.