VDB
DEBIAN-CVE-2025-13465
DEBIAN-CVE-2025-13465
PUBLISHED
CVSS 5.300000190734863 MEDIUM
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | node-lodash | 0, 4.17.21+dfsg+~cs8.31.198.20210220-9 |
| Debian:12 | node-lodash | 0, 4.17.21+dfsg+~cs8.31.198.20210220-9 |
| Debian:14 | node-lodash | 0, 4.17.21+dfsg+~cs8.31.198.20210220-9 |
Timeline
- Jan 21, 2026 CVE Published
- Oct 16, 2026 CVE Updated