CVE-2025-13465Medium· 5.3▾ TwilightPoC availableLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 29.2 · likelihood 0.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
1.5%
1 GitHub repo
Last analysed / modified upstream
1.5% → 1.8%
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
The issue permits deletion of properties but does not allow overwriting their original behavior.
This issue is patched on 4.17.23
lodash >= 4.0.0, < 4.17.23Upgrade past the affected range:
lodash 4.17.23Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-4800High· 8.1Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names
CVE-2026-44495High· 7.0Axios is a promise based HTTP client for the browser and Node.js
CVE-2026-44494High· 8.7Axios is a promise based HTTP client for the browser and Node.js
CVE-2026-42044Medium· 6.5Axios is a promise based HTTP client for the browser and Node.js
CVE-2026-29063Critical· 9.8Immutable.js provides many Persistent Immutable data structures
CVE-2026-42041Medium· 4.8Axios is a promise based HTTP client for the browser and Node.js