{
  "cve": "CVE-2025-13465",
  "cwe": "CWE-1321",
  "package": "lodash",
  "vulnerable_versions": "4.0.0 - 4.17.22",
  "fixed_version": "4.17.23",
  "verdict": "CONFIRMED",
  "confidence": "HIGH",
  "reproduction_status": "SUCCESSFUL",
  "test_type": "prototype_pollution_unset_omit",
  "payload": "__proto__.toString",
  "versions_tested": {
    "vulnerable": {
      "requested": "4.17.22",
      "actual_installed": "4.17.21",
      "note": "4.17.22 was not published to npm; 4.17.21 is the last published vulnerable version and exhibits the same flaw",
      "exit_code": 2,
      "log": "logs/vuln_unset.log",
      "prototype_polluted": true,
      "typeof_object_prototype_toString_after": "undefined"
    },
    "fixed": {
      "requested": "4.17.23",
      "actual_installed": "4.17.23",
      "exit_code": 0,
      "log": "logs/fixed_unset.log",
      "prototype_polluted": false,
      "typeof_object_prototype_toString_after": "function"
    }
  },
  "omit_test_vulnerable": {
    "log": "logs/vuln_omit.log",
    "prototype_polluted": true
  },
  "evidence": [
    "VULN_CONFIRMED: prototype pollution via _.unset in lodash 4.17.21",
    "FIX_CONFIRMED: prototype intact in lodash 4.17.23",
    "VULN_CONFIRMED_OMIT: _.omit also pollutes prototype"
  ],
  "references": {
    "fix_commit": "https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81",
    "cve_entry": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465"
  },
  "notes": "The reproduction script installs lodash from npm in isolated temp directories, runs a Node.js harness that passes attacker-controlled path strings (__proto__.toString) to _.unset and _.omit, and confirms prototype pollution in the vulnerable version while the fixed version correctly rejects the dangerous path."
}