InfoSec Signals™
Sign InStart Free
Back to CVE records
Medium 6.9Published Jan 21, 2026

CVE-2025-13465Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Updated under an hour ago ()

Does this affect you?

It affects lodash and 59 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

CVSS
6.9 MEDIUM (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P
Weakness (CWE)
CWE-1321
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
openjs
NVD analysis
Modified
Record last updated
Oct 15, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
Lodash lodash
lodash:lodash (from the name)
from 4.0.0 before 4.17.23; 4.17.23 not affected
CNA record
Lodash lodash-amd
lodash:amd (from the name)
from 4.0.0 before 4.17.23; 4.17.23 not affected
CNA record
Lodash lodash-es
lodash:es (from the name)
from 4.0.0 before 4.17.23; 4.17.23 not affected
CNA record
Lodash lodash.unset
lodash:lodash.unset (from the name)
from 4.0.0 before 4.18.0; 4.18.0 not affected
CNA record
Lodash lodash.omit
lodash:lodash.omit (from the name)
from 4.0.0 before 4.18.0; 4.18.0 not affected
CNA record
Siemens RUGGEDCOM RST2428P
siemens:ruggedcom_rst2428p (from the name)
before V4.0
CISA ADP
from 4.1.0-17 not affected
CISA ADP
Red Hat HawtIO HawtIO 4.4.0
redhat:apache_camel_hawtio
4.4
CISA ADP
from 0:2.6.6-1.el9ap not affected
CISA ADP
Red Hat Red Hat Data Grid 8.6.0
redhat:jboss_data_grid
from infinispan-console not affected
CISA ADP
from 0:0.12.1-1.el10_1.2 not affected
CISA ADP
from 0:0.12.0-3.el10_0.4 not affected
CISA ADP
from 0:0.10.8-1.el8_4.10 not affected
CISA ADP
from 0:0.10.8-1.el8_4.10 not affected
CISA ADP
from 0:0.10.12-6.el8_6.12 not affected
CISA ADP
from 0:0.10.12-6.el8_6.12 not affected
CISA ADP
from 0:0.11.7-2.el9_4.6 not affected
CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7
redhat:jboss_enterprise_application_platform_eus
from 0:7.3.18-3.GA_redhat_00001.1.el7eap not affected
CISA ADP
2.9
CISA ADP
Red Hat Cluster Observability Operator 1.4.0
redhat:cluster_observability_operator
from 1773337158 not affected
CISA ADP
from 1777128790 not affected
CISA ADP
from 1771227610 not affected
CISA ADP
from 1783350952 not affected
CISA ADP
Red Hat Red Hat Advanced Cluster Security 4.8
redhat:advanced_cluster_security
from 1773235880 not affected
CISA ADP
from 1781863705 not affected
CISA ADP
from 1770656494 not affected
CISA ADP
from 1770913709 not affected
CISA ADP
from 1783502765 not affected
CISA ADP
from 1783690532 not affected
CISA ADP
from 1772093424 not affected
CISA ADP
from 1772633840 not affected
CISA ADP
Red Hat Red Hat Openshift Data Foundation 4.18
redhat:openshift_data_foundation
from 1783676191 not affected
CISA ADP
from 1774448966 not affected
CISA ADP
from 1772195995 not affected
CISA ADP
from 1772110573 not affected
CISA ADP
from 1770140426 not affected
CISA ADP
from 1775069491 not affected; from 1775169226 not affected
CISA ADP
from 1777911535 not affected
CISA ADP
Red Hat Red Hat Trusted Artifact Signer 1.2
redhat:trusted_artifact_signer
from 1770739056 not affected
CISA ADP
Red Hat Confidential Compute Attestation
redhat:confidential_compute_attestation
1
CISA ADP
Red Hat Gatekeeper 3
redhat:gatekeeper
3
CISA ADP
5
CISA ADP
Red Hat Migration Toolkit for Applications 8
redhat:migration_toolkit_applications
8
CISA ADP
Red Hat Migration Toolkit for Virtualization
redhat:migration_toolkit_virtualization
2
CISA ADP
Red Hat Node HealthCheck Operator
redhat:workload_availability_nhc
0
CISA ADP
Red Hat OpenShift Lightspeed
redhat:openshift_lightspeed
All versions
CISA ADP
2
CISA ADP
2
CISA ADP
All versions
CISA ADP
Red Hat Red Hat Connectivity Link 1
redhat:connectivity_link
1
CISA ADP
11
CISA ADP
3
CISA ADP
Red Hat Red Hat Fuse 7
redhat:jboss_fuse
7
CISA ADP
Red Hat Red Hat JBoss Enterprise Application Platform 7
redhat:jboss_enterprise_application_platform
7
CISA ADP
all versions status unknown
CISA ADP
Red Hat Red Hat OpenShift distributed tracing 3
redhat:openshift_distributed_tracing
all versions status unknown
CISA ADP
Red Hat Red Hat OpenShift Virtualization 4
redhat:container_native_virtualization
all versions status unknown
CISA ADP
Red Hat Red Hat Process Automation 7
redhat:jboss_enterprise_bpms_platform
all versions status unknown
CISA ADP
Red Hat Red Hat Single Sign-On 7
redhat:red_hat_single_sign_on
all versions status unknown
CISA ADP
Red Hat Red Hat Trusted Profile Analyzer
redhat:trusted_profile_analyzer
all versions status unknown
CISA ADP

References

  • vendor-advisory

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.