6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-13465

CVE-2025-13465: Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

This issue is patched on 4.17.23

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-13465

CVE-2025-13465:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
lodash	npm	>= 4.0.0, <= 4.17.22	4.17.23
lodash.unset	npm	>= 4.0.0, <= 4.5.2
lodash-es	npm	>= 4.0.0, <= 4.17.22	4.17.23
lodash-amd	npm	>= 4.0.0, <= 4.17.22	4.17.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic prototype pollution issue in the Lodash library, specifically within the _.unset and _.omit functions. The root cause lies in the internal baseUnset function, which is responsible for deleting properties from an object based on a given path. Before the patch, this function did not validate the path, allowing an attacker to craft a path that traverses up to the object's prototype (__proto__) or its constructor's prototype. By doing so, an attacker could delete properties from global objects like Object.prototype, potentially leading to denial of service or other unexpected application behavior.

The patch addresses this by introducing validation within baseUnset to inspect the segments of the provided path. It explicitly blocks paths that contain __proto__ or a constructor.prototype sequence, thus preventing the traversal to and modification of global object prototypes.

The public-facing functions _.unset and _.omit are the primary vectors for this attack, as they both utilize the vulnerable baseUnset logic internally. The provided patch includes new test cases that specifically target these two functions with malicious paths to ensure the vulnerability is fixed and does not regress.

Vulnerable functions

baseUnset

lodash.js

The `baseUnset` function is vulnerable to prototype pollution because it does not properly sanitize the `path` argument. An attacker can provide a crafted path such as `['__proto__', 'polluted']` to delete properties from the `Object.prototype`. The patch adds validation to block paths containing `__proto__` or `constructor.prototype`.

unset

lodash.js

The public `unset` function uses the vulnerable `baseUnset` function internally. As a result, it is directly exploitable. The added tests in the patch confirm that `_.unset` was an intended vector for this vulnerability.

omit

lodash.js

The `omit` function is also vulnerable as it internally relies on functionality that leads to the vulnerable `baseUnset` being called. The vulnerability advisory and the patch's test cases explicitly mention and test `_.omit` for this prototype pollution vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.