Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

TRUNG BÌNH 5.3CVE-2025-13465 · GHSA-xxjr-mmjv-4gpg · Công bố 21/01/2026 · cập nhật 15/10/2026

Tóm tắt nhanh

CVE-2025-13465 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng lodash (lodash), lodash, lodash-amd.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.8%, cao hơn 78.8% các lỗ hổng khác.
Cách xử lý: cập nhật lên 4.17.23 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
lodash lodash	`≥ 4.0.0, < 4.17.23`	`4.17.23`
lodash npm	`≥ 4.0.0, < 4.17.23`	`4.17.23`
lodash-amd npm	`≥ 4.0.0, < 4.17.23`	`4.17.23`
lodash-es npm	`≥ 4.0.0, < 4.17.23`	`4.17.23`
lodash.unset npm	`≥ 4.0.0, ≤ 4.5.2`	Chưa có bản vá

Mô tả

Impact

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

Patches

This issue is patched on 4.17.23.

Mô tả của NVD

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.