MediumGHSA-xxjr-mmjv-4gpgCVE-2025-13465
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
Published 21 Jan 2026 · Updated 17 Oct 2026
Affected packages
lodashnpm
- Affected
- >=4.0.0 <4.17.23
- Fixed in
- 4.17.23
Update to the fixed version for your release line, for example:
npm install lodash@4.17.23lodash.unsetnpm
- Affected
- >=4.0.0 <=4.5.2
- Fixed in
- No fix released
lodash-esnpm
- Affected
- >=4.0.0 <4.17.23
- Fixed in
- 4.17.23
Update to the fixed version for your release line, for example:
npm install lodash-es@4.17.23lodash-amdnpm
- Affected
- >=4.0.0 <4.17.23
- Fixed in
- 4.17.23
Update to the fixed version for your release line, for example:
npm install lodash-amd@4.17.23Details
Impact
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
The issue permits deletion of properties but does not allow overwriting their original behavior.
Patches
This issue is patched on 4.17.23.
Is GHSA-xxjr-mmjv-4gpg in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected lodash, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.