-fides-amor-et-lux (1.0.0), -graphql-codegen-client-preset-swc-test (>=2.0.1, <=2.0.2) +50503 more potentially affected by CVE-2025-13465 +1 more via lodash (>=4.0.0, <=4.17.23)

lodash NPM version =4.0.0, =2.0.1, =1.0.49, =0.0.8, =0.2.0, =0.0.1, =1.0.0, =0.0.1, =2.3.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-F23M-R3PF-42RH...

GHSA-F23M-R3PF-42RH lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Impact Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties fro...

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Impact Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties fro...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +5632 more potentially affected by CVE-2025-13465 +1 more via lodash-es (>=4.0.0, <=4.17.23)

lodash-es NPM version =4.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1-alpha.23, =1.0.0, =1.0.0, =2.14.1, =41.3.1, =2.1.0, =0.3.4, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.4.1 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-F23M-R3PF-42RH...

EUVD-2026-17591

lodash vulnerable to Prototype Pollution via array path bypass in .unset and .omit...

@dojo/cli-test-intern (>=0.1.0, <=2.0.0-beta3.1), express_mvc (>=4.1.1, <=4.3.10) +7 more potentially affected by CVE-2025-13465 +1 more via lodash-amd (>=4.16.4, <=4.17.23)

lodash-amd NPM version =4.16.4, =0.1.0, =4.1.1, =3.4.0, =0.0.1, =1.0.14, =0.0.7, =0.0.1, =0.1.5 - xirtam--matrix-operations 0.1.3 Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: OSV:GHSA-F23M-R3PF-42RH...

CVE-2026-4800

A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function constructor sink. Additionally, .template uses assignInWith to merge imports, whi...

Prototype Pollution

Overview org.webjars.npm:lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Prototype Pollution via the .unset and .omit functions. An attacker can delete properties from built-in prototypes by supplying...

4game-support-ckeditor5-custom-build (>=0.0.1, <=0.0.5), 87-midnight-ckeditor5 (>=0.0.3, <=0.0.5) +5652 more potentially affected by CVE-2025-13465 +1 more via lodash-es (>=4.0.0, <=4.18.0)

lodash-es NPM version =4.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1-alpha.23, =1.0.0, =1.0.0, =2.14.1, =41.3.1, =2.1.0, =0.3.4, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.4.1 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: SNYK:JS-LODASHES-15869621...

-fides-amor-et-lux (1.0.0), -graphql-codegen-client-preset-swc-test (>=2.0.1, <=2.0.2) +50520 more potentially affected by CVE-2025-13465 +1 more via lodash (>=4.0.0, <=4.18.0)

lodash NPM version =4.0.0, =2.0.1, =1.0.49, =0.0.8, =0.2.0, =0.0.1, =1.0.0, =0.0.1, =2.3.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: SNYK:JS-LODASH-15869619...

@dojo/cli-test-intern (>=0.1.0, <=2.0.0-beta3.1), express_mvc (>=4.1.1, <=4.3.10) +7 more potentially affected by CVE-2025-13465 +1 more via lodash-amd (>=4.16.4, <=4.17.23)

lodash-amd NPM version =4.16.4, =0.1.0, =4.1.1, =3.4.0, =0.0.1, =1.0.14, =0.0.7, =0.0.1, =0.1.5 - xirtam--matrix-operations 0.1.3 Source cves: CVE-2025-13465, CVE-2026-2950 Source advisory: SNYK:JS-LODASHAMD-15869622...

Prototype Pollution

Overview lodash.unset is a The lodash method .unset exported as a module. Affected versions of this package are vulnerable to Prototype Pollution via the .unset and .omit functions. An attacker can delete properties from built-in prototypes by supplying array-wrapped path segments, potentially...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the .unset and .omit functions. An attacker can delete properties from built-in prototypes by supplying array-wrapped path segments, potentially impacting application behaviour. Notes: 1 Version 4.18.0 was intend...

Prototype Pollution

Overview lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Prototype Pollution via the .unset and .omit functions. An attacker can delete properties from built-in prototypes by supplying array-wrapped pa...

Prototype Pollution

Overview lodash-amd is a Lodash exported as AMD modules. Affected versions of this package are vulnerable to Prototype Pollution via the .unset and .omit functions. An attacker can delete properties from built-in prototypes by supplying array-wrapped path segments, potentially impacting applicati...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the .unset and .omit functions. An attacker can delete properties from built-in prototypes by supplying array-wrapped path segments, potentially impacting application behaviour. Notes: 1 Version 4.18.0 was intend...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection due the improper validation of options.imports key names in .template. An attacker can execute arbitrary code at template compilation time by injecting malicious expressions. If Object.prototype has been pollute...

Arbitrary Code Injection

Overview lodash-amd is a Lodash exported as AMD modules. Affected versions of this package are vulnerable to Arbitrary Code Injection due the improper validation of options.imports key names in .template. An attacker can execute arbitrary code at template compilation time by injecting malicious...

Arbitrary Code Injection

Overview org.webjars.npm:lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Arbitrary Code Injection due the improper validation of options.imports key names in .template. An attacker can execute arbitrar...

Arbitrary Code Injection

Overview org.webjars.npm:lodash.template is a The Lodash method .template exported as a Node.js module. Affected versions of this package are vulnerable to Arbitrary Code Injection due the improper validation of options.imports key names in .template. An attacker can execute arbitrary code at...