CVE-2025-13465
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.
- Score
- CVSS 3.1 8.2 High
- Status
- Modified - ce714d77-add3-4f53-aff5-83d477b104bb
- Published
- 2026-01-21
- Last modified
- 2026-10-15
- Weaknesses
- CWE-1321
Affected products
- Lodash (Lodash)
- Lodash-amd (Lodash)
- Lodash-es (Lodash)
- Lodash.omit (Lodash)
- Lodash.unset (Lodash)
- Acm (Redhat)
- Advanced Cluster Security (Redhat)
- Amq Streams (Redhat)
- Ansible Automation Platform (Redhat)
- Apache Camel Hawtio (Redhat)
- Ceph Storage (Redhat)
- Cluster Observability Operator (Redhat)
- Confidential Compute Attestation (Redhat)
- Connectivity Link (Redhat)
- Container Native Virtualization (Redhat)
- Cryostat (Redhat)
- Directory Server (Redhat)
- Discovery (Redhat)
- Edge Manager (Redhat)
- Enterprise Linux (Redhat)
- Enterprise Linux Ai (Redhat)
- Enterprise Linux Eus (Redhat)
- Gatekeeper (Redhat)
- Jboss Data Grid (Redhat)
- Jboss Enterprise Application Platform (Redhat)
- Jboss Enterprise Application Platform Eus (Redhat)
- Jboss Enterprise Bpms Platform (Redhat)
- Jboss Fuse (Redhat)
- Jbosseapxp (Redhat)
- Logging (Redhat)
- Migration Toolkit Applications (Redhat)
- Migration Toolkit Virtualization (Redhat)
- Multicluster Engine (Redhat)
- Network Observ Optr (Redhat)
- Openshift (Redhat)
- Openshift Ai (Redhat)
- Openshift Data Foundation (Redhat)
- Openshift Devspaces (Redhat)
- Openshift Distributed Tracing (Redhat)
- Openshift Gitops (Redhat)
- Openshift Lightspeed (Redhat)
- Openshift Pipelines (Redhat)
- Optaplanner (Redhat)
- Quay (Redhat)
- Red Hat 3scale Amp (Redhat)
- Red Hat Single Sign On (Redhat)
- Rhdh (Redhat)
- Rhel Aus (Redhat)
- Rhel E4s (Redhat)
- Rhel Eus (Redhat)
- Rhel Eus Long Life (Redhat)
- Rhel Tus (Redhat)
- Rhmt (Redhat)
- Satellite (Redhat)
- Service Mesh (Redhat)
- Service Registry (Redhat)
- Trusted Artifact Signer (Redhat)
- Trusted Profile Analyzer (Redhat)
- Workload Availability Nhc (Redhat)
- Ruggedcom Rst2428p (Siemens)
References
- https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg
- https://cna.openjsf.org/security-advisories.html
- https://cert-portal.siemens.com/productcert/html/ssa-253495.html
- https://access.redhat.com/security/cve/CVE-2025-13465
- https://bugzilla.redhat.com/show_bug.cgi?id=2431740
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json
- https://access.redhat.com/errata/RHSA-2026:33371
- https://access.redhat.com/errata/RHSA-2026:3958
- https://access.redhat.com/errata/RHSA-2026:1845
- https://access.redhat.com/errata/RHSA-2026:18480
- https://access.redhat.com/errata/RHSA-2026:24331
- https://access.redhat.com/errata/RHSA-2026:18868
- https://access.redhat.com/errata/RHSA-2026:4782
- https://access.redhat.com/errata/RHSA-2026:25089
- https://access.redhat.com/errata/RHSA-2026:2818
- https://access.redhat.com/errata/RHSA-2026:2438
- https://access.redhat.com/errata/RHSA-2026:2462
- https://access.redhat.com/errata/RHSA-2026:2469
- https://access.redhat.com/errata/RHSA-2026:2465
- https://access.redhat.com/errata/RHSA-2026:2484
- https://access.redhat.com/errata/RHSA-2026:2819
- https://access.redhat.com/errata/RHSA-2026:2817
- https://access.redhat.com/errata/RHSA-2026:2816
- https://access.redhat.com/errata/RHSA-2026:2452
- https://access.redhat.com/errata/RHSA-2026:2900
- https://access.redhat.com/errata/RHSA-2026:41064
- https://access.redhat.com/errata/RHSA-2026:5633
- https://access.redhat.com/errata/RHSA-2026:8229
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:13548
