CVE-2025-13465: 
JavaScript vulnerability analysis and mitigation

CVE-2025-13465 is a prototype pollution vulnerability in the Lodash JavaScript utility library affecting the _.unset and _.omit functions. It impacts Lodash versions 4.0.0 through 4.17.22 (including lodash-amd, lodash-es, and lodash.unset packages) and was disclosed on January 21, 2026, via a GitHub Security Advisory. An attacker can pass crafted paths to these functions, causing Lodash to delete methods from global prototypes. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Lodash Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — 'Prototype Pollution'). When _.unset or _.omit process user-controlled path strings (e.g., __proto__.someMethod), they traverse the object prototype chain without sufficient validation, allowing deletion of properties on global prototypes such as Object.prototype. Unlike classic prototype pollution that overwrites properties, this variant only permits deletion — meaning an attacker can remove built-in methods from global prototypes, potentially breaking application logic that depends on those methods. The vulnerability is exploitable remotely without authentication or user interaction, requiring only that attacker-controlled input reaches one of the affected functions (GitHub Advisory, Lodash Advisory).

Successful exploitation allows an unauthenticated remote attacker to delete methods from global JavaScript prototypes (e.g., Object.prototype, Array.prototype), which can disable essential functionality across any application sharing the same JavaScript runtime. This primarily affects integrity and availability: application logic relying on deleted prototype methods may fail unexpectedly, potentially causing denial-of-service conditions or unpredictable behavior. Confidentiality is not directly impacted, but cascading failures in dependent systems could expose secondary attack surfaces. The broad adoption of Lodash across the Node.js ecosystem means the blast radius is significant, with dozens of IBM enterprise products confirmed affected (GitHub Advisory, Lodash Advisory).

The CVSS v4.0 exploit maturity is rated as 'Proof of Concept' (E:P), indicating that PoC-level exploit code exists, though no evidence of active in-the-wild exploitation has been reported as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.045% (0.028% per GitHub Advisory), placing it in a low exploitation probability tier. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been identified. The vulnerability is exploitable without privileges or user interaction, lowering the bar for exploitation in environments where attacker-controlled input reaches _.unset or _.omit.

1. Identify a target application: Locate a Node.js application using Lodash versions 4.0.0–4.17.22 where user-controlled input is passed to _.unset or _.omit (e.g., via API endpoints, form fields, or query parameters).
2. Craft a malicious path: Construct a path string that traverses the prototype chain, such as __proto__.toString or constructor.prototype.hasOwnProperty, targeting a method to delete from a global prototype.
3. Submit the payload: Send the crafted path as input to the vulnerable function — for example, via an HTTP request body: { "path": "__proto__.toString" } if the application passes request data directly to _.unset(obj, req.body.path).
4. Trigger prototype deletion: Lodash processes the path without sanitization, deleting the targeted method from the global prototype (e.g., Object.prototype.toString becomes undefined).
5. Achieve denial of service or logic bypass: Application code or third-party libraries that rely on the deleted prototype method will throw errors or behave unexpectedly, potentially causing service disruption or enabling secondary exploitation (GitHub Advisory, Lodash Advisory).

• Logs: Unexpected TypeError or undefined is not a function errors in application logs referencing prototype methods (e.g., toString, hasOwnProperty, valueOf) that were previously functional.
• Logs: HTTP request logs showing inputs containing path segments such as __proto__, constructor, or prototype passed to API endpoints that invoke _.unset or _.omit.
• Application Behavior: Sudden, unexplained failures in application functionality that relies on standard JavaScript prototype methods, particularly after processing user-supplied path data.
• Dependency Audit: Presence of lodash, lodash-es, lodash-amd, or lodash.unset at versions 4.0.0–4.17.22 in package.json or package-lock.json files.

The primary remediation is to upgrade Lodash to version 4.17.23 or later, which patches the vulnerability in the lodash, lodash-amd, and lodash-es packages (Lodash Advisory). Note that the standalone lodash.unset npm package has no patched version available; organizations using it should migrate to the main lodash package at 4.17.23+. As a temporary workaround, implement strict input validation and sanitization to reject path strings containing __proto__, constructor, or prototype segments before they reach _.unset or _.omit. Numerous IBM enterprise products have issued specific iFixes and security bulletins addressing this CVE — affected IBM customers should consult the relevant product advisories (IBM Advisories).

The vulnerability was reported by security researcher lukas-eu, analyzed by ljharb, and remediated by UlisesGascon and falsyvalues with coordination from jdalton (Lodash maintainer), reflecting a well-coordinated responsible disclosure process (Lodash Advisory). The broad impact across the Node.js ecosystem prompted a large number of downstream vendor advisories, particularly from IBM, which issued over 30 security bulletins for affected products including Cloud Pak, QRadar, Watson, API Connect, and many others. Red Hat also issued multiple errata (RHSA-2026:2145, RHSA-2026:2148, RHSA-2026:2149, and others) addressing the vulnerability in their product portfolio. The mermaid-js project opened a tracking issue to address the dependency, and Ubuntu issued security notice USN-8411-1 for the affected package.