DemoBook a demo

Vulnerability advisory

CVE-2025-13465

Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Published Updated OSV record ↗

Also known as GHSA-xxjr-mmjv-4gpg

Severity
  • CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/lodash/lodash ↗
d35a9c40beb594d09814ba7f7673b81d4d67a816 to before 835a537f36ee2fd5fb7f524e213ff9ba2d8698f8835a537f36ee2fd5fb7f524e213ff9ba2d8698f8

Description

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.