ΠΠΏΠΈΡΠ°Π½ΠΈΠ΅
Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.
| Π Π΅Π»ΠΈΠ· | Π‘ΡΠ°ΡΡΡ | ΠΡΠΈΠΌΠ΅ΡΠ°Π½ΠΈΠ΅ |
|---|---|---|
| devel | needs-triage | |
| esm-apps-legacy/xenial | released | 2.4.1+dfsg-3ubuntu0.1~esm1 |
| esm-apps/bionic | released | 4.17.4+dfsg-1ubuntu0.1~esm1 |
| esm-apps/focal | released | 4.17.15+dfsg-2ubuntu0.1~esm1 |
| esm-apps/jammy | released | 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1 |
| esm-apps/noble | released | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 |
| esm-apps/resolute | released | 4.17.23+dfsg-1ubuntu0.1~esm1 |
| esm-apps/xenial | ignored | end of ESM support, was needs-triage |
| jammy | needed | 4.17.21+dfsg+~cs8.31.198.20210220-5 |
| noble | needed | 4.17.21+dfsg+~cs8.31.198.20210220-9 |
ΠΠΎΠΊΠ°Π·ΡΠ²Π°ΡΡ ΠΏΠΎ
6.5 Medium
CVSS3
Π‘Π²ΡΠ·Π°Π½Π½ΡΠ΅ ΡΡΠ·Π²ΠΈΠΌΠΎΡΡΠΈ
Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.
Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. Patches: This issue is patched in 4.18.0. Workarounds: None. Upgrade to the patched version.
Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototy ...
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Π£ΡΠ·Π²ΠΈΠΌΠΎΡΡΡ Π±ΠΈΠ±Π»ΠΈΠΎΡΠ΅ΠΊΠΈ Lodash, ΡΠ²ΡΠ·Π°Π½Π½Π°Ρ Ρ Π½Π΅ΠΊΠΎΠ½ΡΡΠΎΠ»ΠΈΡΡΠ΅ΠΌΡΠΌ ΠΈΠ·ΠΌΠ΅Π½Π΅Π½ΠΈΠ΅ΠΌ Π°ΡΡΠΈΠ±ΡΡΠΎΠ² ΠΏΡΠΎΡΠΎΡΠΈΠΏΠ° ΠΎΠ±ΡΠ΅ΠΊΡΠ°, ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡΠ°Ρ Π½Π°ΡΡΡΠΈΡΠ΅Π»Ρ ΠΎΠΊΠ°Π·Π°ΡΡ Π²ΠΎΠ·Π΄Π΅ΠΉΡΡΠ²ΠΈΠ΅ Π½Π° ΡΠ΅Π»ΠΎΡΡΠ½ΠΎΡΡΡ ΠΈ Π΄ΠΎΡΡΡΠΏΠ½ΠΎΡΡΡ Π·Π°ΡΠΈΡΠ°Π΅ΠΌΠΎΠΉ ΠΈΠ½ΡΠΎΡΠΌΠ°ΡΠΈΠΈ
6.5 Medium
CVSS3