CVE-2025-13465
EUVD-2025-20631921.01.2026, 20:16
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. This issue is patched on 4.17.23
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| lodash | lodash | 4.0.0 ≤ 𝑥 < 4.17.23 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| Siemens | RUGGEDCOM RST2428P | 𝑥 < V4.0 | ADP |
Debian Releases
openSUSE / SLES Releases
Red Hat Enterprise Linux Releases
Red Hat Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| pcs |
| ||||||||||||
| pcs-snmp |
| ||||||||||||
| sgx-common |
| ||||||||||||
| sgx-libs |
| ||||||||||||
| sgx-mpa |
| ||||||||||||
| sgx-pccs |
| ||||||||||||
| sgx-pccs-admin |
| ||||||||||||
| sgx-pckid-tool |
| ||||||||||||
| tdx-qgs |
|
References