postmanlabs / postmanlabs/postman-code-generators
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 1k
- Forks
- 381
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions
To Reproduce
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
The issue permits deletion of properties but does not allow overwriting their original behavior.
Expected code snippet and corresponding request
Patched version
4.17.23
Additional context
https://nvd.nist.gov/vuln/detail/CVE-2025-13465
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the repository's Lodash dependency and checking uses of _.unset and _.omit against the reported vulnerable range. Update the dependency to 4.17.23 or later, then verify that the vulnerability is no longer present and that existing code-generator behavior is unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100