Name: CVE-2025-13465: Improperly Controlled Modification of Object Prototype Attributes
Creator: Rapid7
Published: 2026-01-21T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2025-13465, CWE-1321, CVSS 5.3, EPSS 0.0185

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

CVSS Details

CVSS 4.0 Base Score: 6.9 (MEDIUM)
CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
CVSS 3.1 Base Score: 5.3
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Alma_linux	—	Upgrade sgx-pckid-toolUpgrade tdx-qgsUpgrade pcs-snmpUpgrade sgx-pccsUpgrade sgx-commonUpgrade pcsUpgrade sgx-mpaUpgrade sgx-libsUpgrade sgx-pccs-admin	Feb 13, 2026	Feb 10, 2026
Debian	—	Upgrade node-lodash	Jul 5, 2026	Jan 21, 2026
Oracle_linux	—	Upgrade pcsUpgrade cockpit-ha-clusterUpgrade sgx-mpaUpgrade cockpit-image-builderUpgrade sgx-libsUpgrade sgx-pccs-adminUpgrade tdx-qgsUpgrade sgx-pccsUpgrade sgx-pckid-toolUpgrade sgx-commonUpgrade pcs-snmp	Feb 12, 2026	Jan 21, 2026
Red Hat Jboss Eap	—	—	Jan 27, 2026	Jan 21, 2026
Redhat_linux	—	Upgrade tdx-qgsUpgrade sgx-pccs-adminUpgrade linux-sgx-debuginfoUpgrade sgx-pccs-debuginfoUpgrade pcsUpgrade tdx-qgs-debuginfoUpgrade sgx-enclave-devel-debuginfoUpgrade cockpit-ha-clusterUpgrade tdx-attest-libs-debuginfoUpgrade sgx-libsUpgrade sgx-mpaUpgrade linux-sgx-debugsourceUpgrade sgx-libs-debuginfoUpgrade pcs-snmpUpgrade sgx-mpa-debuginfoUpgrade sgx-pckid-tool-debuginfoNo solution existsUpgrade sgx-commonUpgrade cockpit-image-builderUpgrade sgx-pckid-toolUpgrade sgx-pccs	Feb 11, 2026	Jan 21, 2026
Rocky_linux	—	Upgrade tdx-qgs-debuginfoUpgrade pcs-snmpUpgrade sgx-pccs-adminUpgrade sgx-mpaUpgrade sgx-pckid-tool-debuginfoUpgrade linux-sgx-debugsourceUpgrade sgx-commonUpgrade linux-sgx-debuginfoUpgrade sgx-pccsUpgrade sgx-libs-debuginfoUpgrade tdx-qgsUpgrade sgx-pccs-debuginfoUpgrade sgx-pckid-toolUpgrade sgx-mpa-debuginfoUpgrade pcsUpgrade sgx-libs	Feb 16, 2026	Feb 13, 2026
Ubuntu	—	Upgrade node-lodash-packages (Ubuntu Pro)Upgrade node-lodashNo solution existsUpgrade libjs-lodash (Ubuntu Pro)Upgrade node-lodash-packagesUpgrade libjs-lodashUpgrade node-lodash (Ubuntu Pro)	Jun 16, 2026	Jun 9, 2026

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence