{
  "ticket_id": "CVE-2025-13465",
  "code_root": "external/lodash",
  "source": {
    "type": "cve",
    "cve_id": "CVE-2025-13465",
    "advisory_id": "GHSA-xxjr-mmjv-4gpg",
    "advisory_url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg",
    "vendor": "lodash",
    "product": "lodash",
    "repo": "https://github.com/lodash/lodash"
  },
  "facts": {
    "cve_id": "CVE-2025-13465",
    "advisory_id": "GHSA-xxjr-mmjv-4gpg",
    "issue_summary": "Prototype pollution in lodash's _.unset and _.omit functions. Both parse a dot/bracket string path and walk it on the target object without rejecting dangerous segments such as __proto__, constructor, or prototype. A crafted string path like '__proto__.toString' makes _.unset traverse from the (empty) target object into Object.prototype and delete a built-in method, polluting the global prototype for the entire Node.js process.",
    "vulnerability_type": "Prototype Pollution (property deletion from global prototypes)",
    "suspected_cwe": ["CWE-1321"],
    "affected_versions": "4.0.0 - 4.17.22 (inclusive)",
    "fixed_versions": ["4.17.23"],
    "reproduce_version": "4.17.22",
    "verify_fixed_version": "4.17.23",
    "repo_url": "https://github.com/lodash/lodash.git",
    "fix_commit": "edadd452146f7e4bad4ea684e955708931d84d81",
    "code_root": "external/lodash",
    "ecosystem": "npm",
    "package": "lodash",
    "affected_functions": ["_.unset", "_.omit"],
    "install_recipe": "In a scratch directory run `npm install lodash@4.17.22` (vulnerable) or `npm install lodash@4.17.23` (fixed). The published npm tarball is the canonical artifact; git tags 4.17.22 / 4.17.23 on the repo are equivalent.",
    "attacker_access": "Any code path that forwards an attacker-influenced path string into _.unset() or _.omit() (e.g. a key derived from JSON request input).",
    "exploit_outline": "Call `_.unset({}, '__proto__.toString')`. The path parses to ['__proto__','toString']; _.unset walks obj['__proto__'] (the live Object.prototype) and deletes its 'toString' member.",
    "vulnerable_indicator": "After the call, `typeof Object.prototype.toString === 'undefined'` and `({}).hasOwnProperty` chain is disturbed -> the method was deleted from the global prototype.",
    "fixed_indicator": "In 4.17.23 _.unset rejects the dangerous string path segment; `typeof Object.prototype.toString === 'function'` is unchanged.",
    "reproduction_requirements": "Node.js (any maintained LTS) plus the lodash package at the specified version. No network service, database, browser, or OS-specific behavior required - the difference is observable purely in-process.",
    "notes": "The 4.17.23 fix only guards string-typed path segments; a later array-path bypass is tracked separately as CVE-2026-2950 (fixed in 4.18.0). This ticket targets the string-path vector covered by CVE-2025-13465 only, so the PoC must use a plain string path."
  }
}