# CVE-2025-13465

## Summary

- **CVE ID:** CVE-2025-13465
- **Severity:** MEDIUM
- **CVSS Score:** 8.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P)
- **CWE:** CWE-1321
- **Published:** Jan 21, 2026
- **Last Modified:** Sep 14, 2026

## Description

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

This issue is patched on 4.17.23

## Affected Products

- Lodash — Lodash (4.0.0)
- Lodash-amd — Lodash-amd (4.0.0)
- lodash-es — lodash-es (4.0.0)
- lodash.unset — lodash.unset (4.0.0)
- npm — lodash (>= 4.0.0, <= 4.17.22)
- npm — lodash.unset (>= 4.0.0, <= 4.5.2)
- npm — lodash-es (>= 4.0.0, <= 4.17.22)
- npm — lodash-amd (>= 4.0.0, <= 4.17.22)

## References

- [CNA](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg)
- [GitHub](https://github.com/advisories/GHSA-xxjr-mmjv-4gpg)
- [siemens-SADP](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2025-13465)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2431740)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3958)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:1845)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:18480)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:24331)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:18868)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:4782)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:25089)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2818)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2438)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2462)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2469)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2465)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2484)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2819)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2817)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2816)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2452)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2900)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5633)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8229)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:13548)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:13829)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:4466)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:4467)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3962)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3960)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33154)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:4630)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2675)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2694)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3782)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:19712)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3870)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3422)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2990)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:15091)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:4423)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:14774)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2661)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20088)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2672)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:21658)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2078)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:20042)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2651)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:17469)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2119)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2984)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6192)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3869)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3874)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3884)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3710)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3825)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2145)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2147)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2148)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2149)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6497)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6567)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:14870)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:14871)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:6288)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:2926)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:3087)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:13542)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:9848)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:5636)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:8218)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:11414)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33371)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34608)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36882)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36651)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:34100)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40138)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40118)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40984)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:40945)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41064)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41928)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41941)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:41944)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:57487)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 1.63%
- **EPSS Percentile:** 75.0

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._