Skip to main content

Lodash CVE-2025-13465

MEDIUM
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)
2026-01-21 ce714d77-add3-4f53-aff5-83d477b104bb GHSA-xxjr-mmjv-4gpg
Information Disclosure Prototype Pollution Lodash
6.9
CVSS 4.0 · Vendor: ce714d77-add3-4f53-aff5-83d477b104bb
View

Vulnerability Assessment

Weakness
CWE
CWE-1321
OWASP Top 10:2025
A03:2021 - Injection
ASVS 5.0
V3 - Web Frontend Security Prototype pollution prevention
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

CVSS 5.3 (MEDIUM). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Lodash versions up to 4.17.22 is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 5.3).

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

Affected Packages

npm lodash fix: 4.17.23, 4.18.0
npm lodash-amd fix: 4.17.23, 4.18.0
npm lodash-es fix: 4.17.23, 4.18.0
npm lodash.unset fix: 4.18.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)) exists in the _.unset and _.omit component. Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

This issue is patched on 4.17.23

Know when Lodash gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (ce714d77-add3-4f53-aff5-83d477b104bb) PRIMARY 6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P
SUSE 5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat 8.2 HIGH

Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).

CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
Low
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
High
Subsequent system: Integrity
High
Subsequent system: Availability
High

Lifecycle Timeline

3
CVSS changed
Jun 02, 2026 - 14:22 NVD
5.3 (MEDIUM) 6.9 (MEDIUM)
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Jan 21, 2026 - 20:16 nvd
MEDIUM 5.3

DescriptionCVE.org

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

This issue is patched on 4.17.23

Executive ViewAI

Why It Matters

CVE-2025-13465 presents moderate security risk, a prototype pollution vulnerability rated CVSS 5.3. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Low
Compensating Controls

Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.

Threat Intelligence Overview

Threat Score
4.9/10
Composite threat intelligence
EPSS Score
0.0%
Top 93% exploitable
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
NVD CVE.org EPSS CISA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Poc
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
Low

Priority Score

64
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +34
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Affected Products (CPE)CVE.org

cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*

More in Lodash

View all
CVE-2021-23337 HIGH POC
7.2 Feb 15

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. Rated high severity (CVS
CVE-2026-4800 CRITICAL POC
9.8 Mar 31

Server-side code injection in Lodash's _.template function (lodash, lodash-es, lodash-amd and lodash.template, versions

CVE-2019-10744 CRITICAL POC
9.1 Jul 26

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. Rated critical severity (CVSS 9.1), this vu
CVE-2020-8203 HIGH POC
7.4 Jul 15

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. Rated high severity (CVSS 7.4), this vul
CVE-2019-1010266 MEDIUM POC
6.5 Jul 17

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. Rated medium severity (CVSS 6.5), th
CVE-2018-3721 MEDIUM POC
6.5 Jun 07

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaults
CVE-2026-2950 MEDIUM
5.3 Mar 31

Prototype pollution in Lodash 4.17.23 and earlier allows unauthenticated remote attackers to delete properties from buil

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all
CVE-2026-34621 HIGH POC
8.6
CVE-2021-23450 CRITICAL POC
9.8
CVE-2024-56059 CRITICAL
9.8
CVE-2021-23383 CRITICAL POC
9.8
CVE-2020-7788 CRITICAL POC
9.8
CVE-2020-28271 CRITICAL POC
9.8
CVE-2023-38894 CRITICAL POC
9.8
CVE-2024-24292 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
Container suse/manager/4.3/proxy-httpd:latest Affected
Container suse/manager/5.0/x86_64/server:latest Affected
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-6.6 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.35 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-188-05
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:1845 ADVISORY https://access.redhat.com/errata/RHSA-2026:2078 ADVISORY https://access.redhat.com/errata/RHSA-2026:2119 ADVISORY https://access.redhat.com/errata/RHSA-2026:2145 ADVISORY https://access.redhat.com/errata/RHSA-2026:2147 ADVISORY https://access.redhat.com/errata/RHSA-2026:2148 ADVISORY https://access.redhat.com/errata/RHSA-2026:2149 ADVISORY https://access.redhat.com/errata/RHSA-2026:2438 ADVISORY https://access.redhat.com/errata/RHSA-2026:2452 ADVISORY https://access.redhat.com/errata/RHSA-2026:2462 ADVISORY https://access.redhat.com/errata/RHSA-2026:2465 ADVISORY https://access.redhat.com/errata/RHSA-2026:2469 ADVISORY https://access.redhat.com/errata/RHSA-2026:2484 ADVISORY https://access.redhat.com/errata/RHSA-2026:2651 ADVISORY https://access.redhat.com/errata/RHSA-2026:2661 ADVISORY https://access.redhat.com/errata/RHSA-2026:2672 ADVISORY https://access.redhat.com/errata/RHSA-2026:2675 ADVISORY https://access.redhat.com/errata/RHSA-2026:2694 ADVISORY https://access.redhat.com/errata/RHSA-2026:2816 ADVISORY https://access.redhat.com/errata/RHSA-2026:2817 ADVISORY https://access.redhat.com/errata/RHSA-2026:2818 ADVISORY https://access.redhat.com/errata/RHSA-2026:2819 ADVISORY https://access.redhat.com/errata/RHSA-2026:2900 ADVISORY https://access.redhat.com/errata/RHSA-2026:2926 ADVISORY https://access.redhat.com/errata/RHSA-2026:2984 ADVISORY https://access.redhat.com/errata/RHSA-2026:2990 ADVISORY https://access.redhat.com/errata/RHSA-2026:3087 ADVISORY https://access.redhat.com/errata/RHSA-2026:3422 ADVISORY https://access.redhat.com/errata/RHSA-2026:3710 ADVISORY https://access.redhat.com/errata/RHSA-2026:3712 ADVISORY https://access.redhat.com/errata/RHSA-2026:3782 ADVISORY https://access.redhat.com/errata/RHSA-2026:3825 ADVISORY https://access.redhat.com/errata/RHSA-2026:3869 ADVISORY https://access.redhat.com/errata/RHSA-2026:3870 ADVISORY https://access.redhat.com/errata/RHSA-2026:3874 ADVISORY https://access.redhat.com/errata/RHSA-2026:3884 ADVISORY https://access.redhat.com/errata/RHSA-2026:3958 ADVISORY https://access.redhat.com/errata/RHSA-2026:3960 ADVISORY https://access.redhat.com/errata/RHSA-2026:3962 ADVISORY https://access.redhat.com/errata/RHSA-2026:4423 ADVISORY https://access.redhat.com/errata/RHSA-2026:4466 ADVISORY https://access.redhat.com/errata/RHSA-2026:4467 ADVISORY https://access.redhat.com/errata/RHSA-2026:4630 ADVISORY https://access.redhat.com/errata/RHSA-2026:4782 ADVISORY https://access.redhat.com/errata/RHSA-2026:5633 ADVISORY https://access.redhat.com/errata/RHSA-2026:5636 ADVISORY https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg ADVISORY https://ubuntu.com/security/notices/USN-8411-1 ADVISORY https://vuldb.com/vuln/342236 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0379/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0396/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0397/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20232/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20236/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20237/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20336/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20337/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20338/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20454/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20494/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20538/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20540/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20576/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20580/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20650/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20653/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20688/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20695/ REF https://access.redhat.com/errata/RHSA-2026:11414 REF https://access.redhat.com/errata/RHSA-2026:13542 REF https://access.redhat.com/errata/RHSA-2026:13548 REF https://access.redhat.com/errata/RHSA-2026:13829 REF https://access.redhat.com/errata/RHSA-2026:14774 REF https://access.redhat.com/errata/RHSA-2026:14870 REF https://access.redhat.com/errata/RHSA-2026:14871 REF https://access.redhat.com/errata/RHSA-2026:15091 REF https://access.redhat.com/errata/RHSA-2026:17469 REF https://access.redhat.com/errata/RHSA-2026:18480 REF https://access.redhat.com/errata/RHSA-2026:18868 REF https://access.redhat.com/errata/RHSA-2026:19712 REF https://access.redhat.com/errata/RHSA-2026:20042 REF https://access.redhat.com/errata/RHSA-2026:20088 REF https://access.redhat.com/errata/RHSA-2026:21658 REF https://access.redhat.com/errata/RHSA-2026:24331 REF https://access.redhat.com/errata/RHSA-2026:25089 REF https://access.redhat.com/errata/RHSA-2026:33154 REF https://access.redhat.com/errata/RHSA-2026:33371 REF https://access.redhat.com/errata/RHSA-2026:34100 REF https://access.redhat.com/errata/RHSA-2026:34608 REF https://access.redhat.com/errata/RHSA-2026:36651 REF https://access.redhat.com/errata/RHSA-2026:36882 REF https://access.redhat.com/errata/RHSA-2026:40118 REF https://access.redhat.com/errata/RHSA-2026:40138 REF https://access.redhat.com/errata/RHSA-2026:40945 REF https://access.redhat.com/errata/RHSA-2026:40984 REF https://access.redhat.com/errata/RHSA-2026:41064 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:41941 REF https://access.redhat.com/errata/RHSA-2026:41944 REF https://access.redhat.com/errata/RHSA-2026:57487 REF https://access.redhat.com/errata/RHSA-2026:6192 REF https://access.redhat.com/errata/RHSA-2026:6288 REF https://access.redhat.com/errata/RHSA-2026:6497 REF https://access.redhat.com/errata/RHSA-2026:6567 REF https://access.redhat.com/errata/RHSA-2026:8218 REF https://access.redhat.com/errata/RHSA-2026:8229 REF https://access.redhat.com/errata/RHSA-2026:9848 REF https://access.redhat.com/security/cve/CVE-2025-13465 REF https://bugzilla.redhat.com/show_bug.cgi?id=2431740 REF https://cert-portal.siemens.com/productcert/html/ssa-253495.html REF https://cna.openjsf.org/security-advisories.html REF https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy