GitHub Advisoryadvisory · npm

GHSA-xxjr-mmjv-4gpg Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

MEDIUM Published 2026-01-21 Modified 2026-06-09 Official page ↗
Aliases
CVE-2025-13465
Ecosystem
npm
Packages
lodash, lodash.unset, lodash-es, lodash-amd
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Weaknesses
CWE-1321
Reviewed
2026-01-21

Affected packages

• npm lodash: >= 4.0.0, < 4.17.23 → fixed in 4.17.23 • npm lodash.unset: >= 4.0.0, <= 4.5.2 (no fix yet) • npm lodash-es: >= 4.0.0, < 4.17.23 → fixed in 4.17.23 • npm lodash-amd: >= 4.0.0, < 4.17.23 → fixed in 4.17.23

Description

Impact Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. Patches This issue is patched on 4.17.23.

Related

Alias · CVE (1)

  • CVE-2025-13465 The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References