GHSA-f23m-r3pf-42rh
MediumAdvisory
Published 21 Jan 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.5
- base score, highest
- EPSS
- 0.016
- 75th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 472
- of 17,787 indexed, latest versions
- Container images
- 491
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Carried by container images the latest versions of 472 of 17,787 indexed charts deploy, on 491 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| lodashnpm | 0.9.2, 1.0.2, 1.3.1, 2.4.1+13 more | 4.17.23, 4.18.0 | 487 |
| lodash-esnpm | 4.17.4, 4.17.15, 4.17.20, 4.17.21+2 more | 4.17.23, 4.18.0 | 113 |
| lodash.unsetnpm | 4.5.2, 4.17.15, 4.17.21 | 4.18.0 | 6 |
- OSV records
- GHSA-f23m-r3pf-42rhGHSA-xxjr-mmjv-4gpg
- Also known as
- CVE-2025-13465, CVE-2026-2950
Charts affected
472 by stars
Container images carrying it
491 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| sqlpad/ | d3d2f430dffd | lodash lodash | 4.17.23 4.18.0 | 1 |
| stanfordoval/ | 1a63cdccedaf | lodash lodash | 4.17.23 4.18.0 | 1 |
| subsquid/ | a7f8b9bad7ee | lodash lodash | 4.17.23 4.18.0 | 1 |
| supabase/ | f983fb50bd95 | lodash lodash | 4.17.23 4.18.0 | 1 |
| supabase/ | 26d8070c55e9 | lodash lodash | 4.17.23 4.18.0 | 1 |
| svenwal/ | ba2f285af432 | lodash lodash | 4.17.23 4.18.0 | 1 |
| svtechnmaa/ | 1d71314424aa | lodash lodash lodash.unset | 4.17.23 4.18.0 4.18.0 | 1 |
| sysnet4admin/ | e74b43c7f492 | lodash lodash | 4.17.23 4.18.0 | 1 |
| sysnet4admin/ | 5802bfcd7fed | lodash lodash | 4.17.23 4.18.0 | 1 |
| temporalio/ | 33cfa863d8ce | lodash lodash lodash-es lodash-es | 4.17.23 4.18.0 4.17.23 4.18.0 | 1 |
| testhubio/ | e86c2db53be8 | lodash lodash | 4.17.23 4.18.0 | 1 |
| thecodingmachine/ | 64001369dad5 | lodash lodash | 4.17.23 4.18.0 | 1 |
| thecodingmachine/ | 5bdab56da2fa | lodash lodash | 4.17.23 4.18.0 | 1 |
| thecodingmachine/ | d8f66979b9b4 | lodash lodash | 4.17.23 4.18.0 | 1 |
| thecodingmachine/ | 3ccd467543b3 | lodash lodash | 4.17.23 4.18.0 | 1 |
| thelounge/ | 0037aa258261 | lodash lodash | 4.17.23 4.18.0 | 1 |
| thelounge/ | 639978459c3a | lodash lodash | 4.17.23 4.18.0 | 1 |
| thmmniii/ | a347f7f4d144 | lodash lodash | 4.17.23 4.18.0 | 1 |
| timothyclarke/ | 22c41e5ca7e2 | lodash lodash | 4.17.23 4.18.0 | 1 |
| tooljet/ | c85a4720e42e | lodash lodash | 4.17.23 4.18.0 | 1 |
| treskon/ | e7970783bc8d | lodash lodash | 4.17.23 4.18.0 | 1 |
| tzahi12345/ | 3720b856bd2f | lodash lodash | 4.17.23 4.18.0 | 1 |
| ubercadence/ | 8564a5b44a6d | lodash lodash lodash-es lodash-es | 4.17.23 4.18.0 4.17.23 4.18.0 | 1 |
| unitycatalog/ | 3a688197b218 | lodash lodash | 4.17.23 4.18.0 | 1 |
| unleashorg/ | 245aeba40053 | lodash lodash.unset lodash.unset | 4.18.0 no fix listed 4.18.0 | 1 |
| unleashorg/ | 9adb37e399ba | lodash | 4.18.0 | 1 |
| vabene1111/ | ec4e9e2905b0 | lodash lodash | 4.17.23 4.18.0 | 1 |
| visualregressiontracker/ | 941aeb8c8bf9 | lodash lodash | 4.17.23 4.18.0 | 1 |
| vlebediantsev/ | 007c6670ff48 | lodash lodash | 4.17.23 4.18.0 | 1 |
| vlebediantsev/ | 945675fd2636 | lodash lodash | 4.17.23 4.18.0 | 1 |
| vlebediantsev/ | 54f69d116c50 | lodash lodash | 4.17.23 4.18.0 | 1 |
| wazuh/ | 0c58e7b47bb6 | lodash lodash lodash-es lodash-es | 4.17.23 4.18.0 4.17.23 4.18.0 | 1 |
| wazuh/ | 1787550d2358 | lodash lodash lodash-es lodash-es | 4.17.23 4.18.0 4.17.23 4.18.0 | 1 |
| wazuh/ | 91c8d793746f | lodash lodash lodash-es lodash-es | 4.17.23 4.18.0 4.17.23 4.18.0 | 1 |
| wazuh/ | 91e4f0a7feed | lodash lodash lodash-es lodash-es | 4.17.23 4.18.0 4.17.23 4.18.0 | 1 |
| wekanteam/ | 68a51f0327df | lodash lodash | 4.17.23 4.18.0 | 1 |
| willwill/ | d443017aae98 | lodash lodash | 4.17.23 4.18.0 | 1 |
| winfred008/ | 10a68de5b398 | lodash lodash | 4.17.23 4.18.0 | 1 |
| wiremind/ | e7048929a676 | lodash lodash | 4.17.23 4.18.0 | 1 |
| xom4ekp2p/ | d0e0aa238b02 | lodash lodash | 4.17.23 4.18.0 | 1 |
| ymuski/ | 67819ca511b5 | lodash lodash | 4.17.23 4.18.0 | 1 |
| youssef11gaber10/ | ba6853e35c60 | lodash lodash | 4.17.23 4.18.0 | 1 |
| yuzutech/ | 57917319ea70 | lodash-es lodash-es | 4.17.23 4.18.0 | 1 |
| yuzutech/ | 963b4acfde6e | lodash lodash | 4.17.23 4.18.0 | 1 |
| zazuko/ | 054be137de70 | lodash lodash | 4.17.23 4.18.0 | 1 |
| zimengxiong/ | 1273af713c91 | lodash | 4.18.0 | 1 |
| zooz/ | f491d1f7a865 | lodash lodash | 4.17.23 4.18.0 | 1 |
| zwavejs/ | 15a6040fb468 | lodash lodash | 4.17.23 4.18.0 | 1 |
| zwavejs/ | 14d018bb689e | lodash | 4.18.0 | 1 |
| ghcr.io/ | a52dc5db694a | lodash lodash | 4.17.23 4.18.0 | 1 |