Name: CVE-2025-13465: Improperly Controlled Modification of Object Prototype Attributes
Creator: Rapid7
Published: 2026-01-21T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2025-13465, CWE-1321, CVSS 5.3, EPSS 0.0185

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

CVSS Details

CVSS 4.0 Base Score: 6.9 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 5.3
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade pcs-snmpUpgrade sgx-pccsUpgrade sgx-pckid-toolUpgrade sgx-commonUpgrade tdx-qgsUpgrade sgx-mpaUpgrade pcsUpgrade sgx-pccs-adminUpgrade sgx-libs	Feb 13, 2026	Feb 10, 2026
Debian	—	Upgrade node-lodash	Jul 5, 2026	Jan 21, 2026
Oracle_linux	—	Upgrade sgx-libsUpgrade sgx-mpaUpgrade tdx-qgsUpgrade sgx-pccs-adminUpgrade sgx-pccsUpgrade cockpit-ha-clusterUpgrade cockpit-image-builderUpgrade pcsUpgrade pcs-snmpUpgrade sgx-commonUpgrade sgx-pckid-tool	Feb 12, 2026	Jan 21, 2026
Red Hat Jboss Eap	—	—	Jan 27, 2026	Jan 21, 2026
Redhat_linux	—	Upgrade sgx-libsUpgrade cockpit-ha-clusterUpgrade pcsUpgrade linux-sgx-debugsourceUpgrade sgx-enclave-devel-debuginfoUpgrade sgx-mpaUpgrade tdx-attest-libs-debuginfoUpgrade linux-sgx-debuginfoUpgrade tdx-qgs-debuginfoUpgrade tdx-qgsUpgrade sgx-pccs-adminUpgrade sgx-pccs-debuginfoUpgrade sgx-commonUpgrade sgx-pckid-tool-debuginfoUpgrade cockpit-image-builderUpgrade sgx-pckid-toolUpgrade pcs-snmpUpgrade sgx-libs-debuginfoUpgrade sgx-pccsUpgrade sgx-mpa-debuginfoNo solution exists	Feb 11, 2026	Jan 21, 2026
Rocky_linux	—	Upgrade sgx-pccs-debuginfoUpgrade sgx-libs-debuginfoUpgrade sgx-pccsUpgrade sgx-pckid-toolUpgrade sgx-mpa-debuginfoUpgrade sgx-libsUpgrade tdx-qgsUpgrade pcsUpgrade linux-sgx-debuginfoUpgrade sgx-commonUpgrade pcs-snmpUpgrade sgx-mpaUpgrade sgx-pccs-adminUpgrade sgx-pckid-tool-debuginfoUpgrade tdx-qgs-debuginfoUpgrade linux-sgx-debugsource	Feb 16, 2026	Feb 13, 2026
Ubuntu	—	Upgrade libjs-lodashUpgrade libjs-lodash (Ubuntu Pro)Upgrade node-lodash-packagesUpgrade node-lodash (Ubuntu Pro)No solution existsUpgrade node-lodashUpgrade node-lodash-packages (Ubuntu Pro)	Jun 16, 2026	Jun 9, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence