Към съдържанието
Търсене

CVE-2025-13465: lodash, инжекция

8.2

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

Засегнати продукти

  • Lodash lodash: 4.0.0 преди 4.17.23; 4.17.23
  • Lodash lodash-amd: 4.0.0 преди 4.17.23; 4.17.23
  • Lodash lodash-es: 4.0.0 преди 4.17.23; 4.17.23
  • Lodash lodash.unset: 4.0.0 преди 4.18.0; 4.18.0
  • Lodash lodash.omit: 4.0.0 преди 4.18.0; 4.18.0
  • Siemens RUGGEDCOM RST2428P: преди V4.0
  • Red Hat: още 116 продукта, добавени от Red Hat

    Cryostat 4 on RHEL 9, HawtIO HawtIO 4.4.0, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Data Grid 8.6.0, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7, Streams for Apache Kafka 2.9.4, Cluster Observability Operator 1.4.0, multicluster engine for Kubernetes 2.1, multicluster engine for Kubernetes 2.6, multicluster engine for Kubernetes 2.7, multicluster engine for Kubernetes 2.8, multicluster engine for Kubernetes 2.9, Network Observability (NETOBSERV) 1.11.0, Red Hat Advanced Cluster Management for Kubernetes 2.11, Red Hat Advanced Cluster Management for Kubernetes 2.12, Red Hat Advanced Cluster Management for Kubernetes 2.13, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat Advanced Cluster Security 4.8, Red Hat Advanced Cluster Security 4.9, Red Hat Advanced Cluster Security for Kubernetes 4.10, Red Hat Ansible Automation Platform 2.5, Red Hat Ansible Automation Platform 2.6, Red Hat Ceph Storage 7.1, Red Hat Developer Hub 1.8, Red Hat Discovery 2, Red Hat Edge Manager 1.0, Red Hat Edge Manager 1.1, Red Hat Migration Toolkit 1.8, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4.21, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.19, Red Hat Openshift Data Foundation 4.20, Red Hat OpenShift Dev Spaces 3.27, Red Hat OpenShift GitOps 1.17, Red Hat OpenShift GitOps 1.18, Red Hat OpenShift GitOps 1.19, Red Hat OpenShift Pipelines 1.15, Red Hat OpenShift Pipelines 1.2, Red Hat OpenShift Service Mesh 2.6, Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift Service Mesh 3.1, Red Hat OpenShift Service Mesh 3.2, Red Hat Quay 3.16, Red Hat Satellite 6.18, Red Hat Trusted Artifact Signer 1.2, Red Hat Trusted Artifact Signer 1.3, Confidential Compute Attestation, Gatekeeper 3, Logging Subsystem for Red Hat OpenShift, Migration Toolkit for Applications 8, Migration Toolkit for Virtualization, Multicluster Engine for Kubernetes, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, OpenShift Service Mesh 2, OpenShift Service Mesh 3, Red Hat 3scale API Management Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 2, Red Hat build of OptaPlanner 8, Red Hat Ceph Storage 4, Red Hat Ceph Storage 5, Red Hat Ceph Storage 6, Red Hat Ceph Storage 8, Red Hat Connectivity Link 1, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Directory Server 13, Red Hat Edge Manager preview, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift distributed tracing 3, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Red Hat Process Automation 7, Red Hat Quay 3, Red Hat Satellite 6, Red Hat Single Sign-On 7, Red Hat Trusted Profile Analyzer, streams for Apache Kafka 3

Вид слабост

История

  • 21 януари 2026 Публикувано

Други уязвимости в Lodash lodash

Първоизточници

CVE-2025-13465: lodash, инжекция | freedomonline.bg