NetSight
IP …
medium6.5

CVE-2025-13465

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

Impact

### Impact Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. ### Patches This issue is patched on 4.17.23.

Affected packages

EcosystemPackageAffectedFixed in
npmlodash>= 4.0.0, <= 4.17.224.17.23
npmlodash.unset>= 4.0.0, <= 4.5.2none recorded
npmlodash-es>= 4.0.0, <= 4.17.224.17.23
npmlodash-amd>= 4.0.0, <= 4.17.224.17.23

Affected products

VendorProductAffected versions
LodashLodash
from 4.0.0 before 4.17.23

Weakness classification

CWE-1321

References