Skip to content
fr Sign in
6.9 Medium

CVE-2025-13465 The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution

Description

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Affected products and versions

Product Affected versions Fixed in
lodash 4.17 earliest → < 4.17.23 4.17.23
lodash 4.0 4.0.0 → < 4.17.23 4.17.23
Lodash-amd 4.0 4.0.0 → 4.17.22 No fix stated
lodash-es 4.0 4.0.0 → 4.17.22 No fix stated
lodash.unset 4.0.0 No fix stated
RUGGEDCOM RST2428P 4.0 earliest → < 4.0 4.0
Red Hat Ansible Automation Platform 2.6 for RHEL 9 Versions not published
Cryostat 4 on RHEL 9 4.1 earliest → < 4.1.0-17 4.1.0-17
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Show the 157 other branches
Product Affected versions Fixed in
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Cluster Observability Operator 1.4.0 1773337078 earliest → < 1773337078 1773337078
HawtIO HawtIO 4.4.0 Versions not published
Red Hat Enterprise Linux High Availability EUS (v. 10.0) Versions not published
Red Hat Enterprise Linux High Availability (v. 10) Versions not published
Red Hat Enterprise Linux High Availability AUS (v.8.4) Versions not published
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) Versions not published
Red Hat Enterprise Linux High Availability E4S (v.8.6) Versions not published
Red Hat Enterprise Linux High Availability TUS (v.8.6) Versions not published
Red Hat Enterprise Linux High Availability E4S (v.8.8) Versions not published
Red Hat Enterprise Linux High Availability TUS (v.8.8) Versions not published
Red Hat Enterprise Linux High Availability E4S (v.9.0) Versions not published
Red Hat Enterprise Linux High Availability E4S (v.9.2) Versions not published
Red Hat Enterprise Linux High Availability EUS (v.9.4) Versions not published
Red Hat Enterprise Linux High Availability EUS (v.9.6) Versions not published
Red Hat Enterprise Linux High Availability (v. 9) Versions not published
Network Observability (NETOBSERV) 1.11.2 1771227650 earliest → < 1771227650 1771227650
Red Hat Advanced Cluster Management for Kubernetes 2.12 1773259174 earliest → < 1773259174 1773259174
Red Hat Advanced Cluster Management for Kubernetes 2.13 1775116130 earliest → < 1775116130 1775116130
Red Hat Advanced Cluster Management for Kubernetes 2.15 1776927126 earliest → < 1776927126 1776927126
Red Hat Advanced Cluster Security for Kubernetes 4.10 1777976489 earliest → < 1777976489 1777976489
Red Hat Advanced Cluster Security for Kubernetes 4.8 1773235880 earliest → < 1773235880 1773235880
Red Hat Advanced Cluster Security for Kubernetes 4.9 1773235860 earliest → < 1773235860 1773235860
Red Hat Ansible Automation Platform 2.5 1772214630 earliest → < 1772214630 1772214630
Red Hat Ansible Automation Platform 2.6 1772552788 earliest → < 1772552788 1772552788
Red Hat Ceph Storage 7.1 1781863705 earliest → < 1781863705 1781863705
Red Hat Data Grid 8.6.0 Versions not published
Red Hat Developer Hub 1.8 1770656494 earliest → < 1770656494 1770656494
Red Hat Discovery 2 1770913709 earliest → < 1770913709 1770913709
Red Hat OpenShift AI 2.25 1772093498 earliest → < 1772093498 1772093498
Red Hat OpenShift AI 3.3 1778666987 earliest → < 1778666987 1778666987
Red Hat OpenShift Container Platform 4.12 1772633840 earliest → < 1772633840 1772633840
Red Hat OpenShift Container Platform 4.13 1771854568 earliest → < 1771854568 1771854568
Red Hat OpenShift Container Platform 4.14 1771425150 earliest → < 1771425150 1771425150
Red Hat OpenShift Container Platform 4.15 1773067104 earliest → < 1773067104 1773067104
Red Hat OpenShift Container Platform 4.16 1770831186 earliest → < 1770831186 1770831186
Red Hat OpenShift Container Platform 4.17 1782269794 earliest → < 1782269794 1782269794
Red Hat OpenShift Container Platform 4.18 1787031225 earliest → < 1787031225 1787031225
Red Hat OpenShift Container Platform 4.19 1770665886 earliest → < 1770665886 1770665886
Red Hat OpenShift Container Platform 4.20 1769816382 earliest → < 1769816382 1769816382
Red Hat OpenShift Container Platform 4.21 1771393951 earliest → < 1771393951 1771393951
Red Hat OpenShift Dev Spaces 3.27 1774227265 earliest → < 1774227265 1774227265
Red Hat OpenShift GitOps 1.17 1772195995 earliest → < 1772195995 1772195995
Red Hat OpenShift GitOps 1.18 1772438822 earliest → < 1772438822 1772438822
Red Hat OpenShift GitOps 1.19 1772447156 earliest → < 1772447156 1772447156
Red Hat OpenShift Pipelines 1.15 1772110573 earliest → < 1772110573 1772110573
Red Hat OpenShift Pipelines 1.2 1770988020 earliest → < 1770988020 1770988020
Red Hat OpenShift Service Mesh 2.6 1770140470 earliest → < 1770140470 1770140470
Red Hat OpenShift Service Mesh 3.0 1770140853 earliest → < 1770140853 1770140853
Red Hat OpenShift Service Mesh 3.1 1770138727 earliest → < 1770138727 1770138727
Red Hat OpenShift Service Mesh 3.2 1770138513 earliest → < 1770138513 1770138513
Red Hat Quay 3.16 1775169226 earliest → < 1775169226 1775169226
Red Hat Quay 3.16 1775069491 earliest → < 1775069491 1775069491
Red Hat Satellite 6.18 1773242477 earliest → < 1773242477 1773242477
Red Hat Trusted Artifact Signer 1.2 1770739056 earliest → < 1770739056 1770739056
Red Hat Trusted Artifact Signer 1.3 1771324807 earliest → < 1771324807 1771324807
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) Versions not published
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) Versions not published
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) Versions not published
Red Hat Enterprise Linux Resilient Storage EUS (v.9.6) Versions not published
Red Hat Enterprise Linux Resilient Storage (v. 9) Versions not published
multicluster engine for Kubernetes 2.10 1777128790 earliest → < 1777128790 1777128790
multicluster engine for Kubernetes 2.6 1776223790 earliest → < 1776223790 1776223790
multicluster engine for Kubernetes 2.7 1773100128 earliest → < 1773100128 1773100128
multicluster engine for Kubernetes 2.8 1775116156 earliest → < 1775116156 1775116156
multicluster engine for Kubernetes 2.9 1777301444 earliest → < 1777301444 1777301444
Logging Subsystem for Red Hat OpenShift Versions not published
Migration Toolkit for Applications 8 Versions not published
Migration Toolkit for Containers Versions not published
Migration Toolkit for Virtualization Versions not published
Node HealthCheck Operator Versions not published
OpenShift Lightspeed Versions not published
OpenShift Pipelines Versions not published
Red Hat 3scale API Management Platform 2 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2 Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Red Hat build of OptaPlanner 8 Versions not published
Red Hat Ceph Storage 4 Versions not published
Red Hat Ceph Storage 5 Versions not published
Red Hat Ceph Storage 6 Versions not published
Red Hat Ceph Storage 8 Versions not published
Red Hat Connectivity Link 1 Versions not published
Red Hat Edge Manager 1 Versions not published
Red Hat Edge Manager preview Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Enterprise Linux AI (RHEL AI) 3 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Container Platform 4 Versions not published
Red Hat Openshift Data Foundation 4 Versions not published
Red Hat OpenShift distributed tracing 3 Versions not published
Red Hat OpenShift GitOps Versions not published
Red Hat OpenShift Virtualization 4 Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat Trusted Profile Analyzer Versions not published
streams for Apache Kafka 2 Versions not published
streams for Apache Kafka 3 Versions not published
Red Hat Ansible Automation Platform 2.6 for RHEL 10 Versions not published
Confidential Compute Attestation Versions not published
Gatekeeper 3 Versions not published
Multicluster Engine for Kubernetes Versions not published
OpenShift Service Mesh 2 Versions not published
OpenShift Service Mesh 3 Versions not published
Red Hat Advanced Cluster Security 4 Versions not published
Red Hat Directory Server 11 Versions not published
Red Hat Directory Server 12 Versions not published
Red Hat Directory Server 13 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Red Hat Quay 3 Versions not published
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server Versions not published
Streams for Apache Kafka 2.9.4 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729 earliest → < 1783451729 1783451729
Red Hat Edge Manager 1.0 1783502438 earliest → < 1783502438 1783502438
Red Hat OpenShift Service Mesh 3 1770140853 earliest → < 1770140853 1770140853
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Versions not published
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Versions not published
Red Hat Enterprise Linux 8.6 Telecommunications Update Service Versions not published
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 8.8 Telecommunications Update Service Versions not published
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Versions not published
Red Hat Enterprise Linux 9.4 Extended Update Support Versions not published
Red Hat Enterprise Linux 9.6 Extended Update Support Versions not published
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Versions not published
Red Hat Advanced Cluster Management for Kubernetes 2.11 1783350952 earliest → < 1783350952 1783350952
Red Hat Edge Manager 1.1 1784127736 earliest → < 1784127736 1784127736
Red Hat Openshift Data Foundation 4.20 1783669219 earliest → < 1783669219 1783669219
multicluster engine for Kubernetes 2.1 1777128790 earliest → < 1777128790 1777128790
multicluster engine for Kubernetes 2.9.0 1777301444 earliest → < 1777301444 1777301444
Red Hat Advanced Cluster Security 4.8 1773235880 earliest → < 1773235880 1773235880
Red Hat Advanced Cluster Security 4.9 1773235860 earliest → < 1773235860 1773235860
Red Hat OpenShift Container Platform 4.2 1769816382 earliest → < 1769816382 1769816382
Red Hat Openshift Data Foundation 4.2 1783669219 earliest → < 1783669219 1783669219
Red Hat Migration Toolkit 1.8 1783690532 earliest → < 1783690532 1783690532
Red Hat Openshift Data Foundation 4.18 1783677533 earliest → < 1783677533 1783677533
Red Hat Openshift Data Foundation 4.19 1783685375 earliest → < 1783685375 1783685375
Network Observability (NETOBSERV) 1.11.1 1771227650 earliest → < 1771227650 1771227650
Network Observability (NETOBSERV) 1.11.0 1771227650 earliest → < 1771227650 1771227650
lodash-amd 4.17 earliest → < 4.17.23 4.17.23
lodash-amd 4.0 4.0.0 → < 4.17.23 4.17.23
lodash-es 4.17 earliest → < 4.17.23 4.17.23
lodash-es 4.0 4.0.0 → < 4.17.23 4.17.23
lodash.unset 4.18 earliest → < 4.18.0 4.18.0
lodash.unset 4.0 4.0.0 → < 4.18.0 4.18.0
lodash.omit 4.18 earliest → < 4.18.0 4.18.0
lodash.omit 4.0 4.0.0 → < 4.18.0 4.18.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of lodash

The 4 CVEs of lodash →
CVE-2026-4800 The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same… 8.1 High CVE-2026-2950 The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution 6.5 Medium CVE-2019-1010266 lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption Not rated
Track this CVE