{
  "cve": "CVE-2025-13465",
  "cwe": "CWE-1321",
  "test_type": "prototype_pollution_unset_omit",
  "payload": "__proto__.toString",
  "versions_tested": {
    "vulnerable": {
      "requested": "4.17.22",
      "actual_installed": "4.17.21",
      "note": "4.17.22 was not published to npm; 4.17.21 is the last published vulnerable version and exhibits the same flaw",
      "exit_code": 2,
      "log": "/root/.pruva/runs/cve-2025-13465_20260522-075758/logs/vuln_unset.log",
      "prototype_polluted": true,
      "typeof_object_prototype_toString_after": "undefined"
    },
    "fixed": {
      "requested": "4.17.23",
      "actual_installed": "4.17.23",
      "exit_code": 0,
      "log": "/root/.pruva/runs/cve-2025-13465_20260522-075758/logs/fixed_unset.log",
      "prototype_polluted": false,
      "typeof_object_prototype_toString_after": "function"
    }
  },
  "omit_test_vulnerable": {
    "log": "/root/.pruva/runs/cve-2025-13465_20260522-075758/logs/vuln_omit.log",
    "prototype_polluted": true
  },
  "result": "confirmed",
  "markers": [
    "VULN_CONFIRMED: prototype pollution via _.unset in lodash 4.17.21",
    "FIX_CONFIRMED: prototype intact in lodash 4.17.23",
    "VULN_CONFIRMED_OMIT: _.omit also pollutes prototype"
  ]
}