CVE-2025-13465VulnerabilityPublished 31 Mar 2026Updated 1 Nov 2026

Red Hat Security Advisory: General availability of the satellite/iop-remediations-rhel9 container image

Affects Red HatSource GCVE Database

Compare

Not known to be exploited.

Data as of 1 Nov 2026, 08:20 UTC

Severity

High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 1.8% chance of exploitation in 30 days – higher than 78% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 31 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 31 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate this vulnerability, implement strict input validation to prevent user input from controlling property paths passed to _.unset and _.omit functions. Specifically, block strings that access the prototype chain such as __proto__, constructor, and prototype. Follow Red Hat Satellite documentation for installing and configuring Red Hat Lightspeed locally to generate recommendations without sending data externally.

Description

CVE-2025-13465 is a prototype pollution vulnerability in the Lodash library's _.unset and _.omit functions. This flaw allows an attacker who can control property paths to delete methods from global prototypes, potentially causing denial of service by removing essential functionalities. The vulnerability only permits deletion of properties, not overwriting behavior, limiting the impact to denial of service. It affects applications using these Lodash functions with user-controlled input for property paths. Red Hat Satellite includes Red Hat Lightspeed, which uses Lodash in the pcs-web-ui component; however, this component is no longer included in RHEL 8.10, which is therefore not affected. Mitigation involves strict input validation to block prototype chain access. No fix is currently provided in Red Hat Satellite, but the advisory provides guidance on mitigation.

Impact

The vulnerability allows denial of service by deleting essential methods from global prototypes, impairing application functionality. It does not allow code execution or data modification beyond property deletion. The impact is limited to applications that use Lodash _.unset and _.omit with user-controlled property paths. In Red Hat Satellite, this affects the pcs-web-ui component, but RHEL 8.10 and later do not include this component and are not affected. The severity is important due to potential denial of service.

Summary

CVE-2025-13465 is a prototype pollution vulnerability in Lodash's _.unset and _.omit functions that allows deletion of methods from global prototypes when user input controls the property path. This can lead to denial of service by removing essential functionalities. The vulnerability requires that the application uses these functions on objects with user-controlled property paths. Red Hat Satellite's Red Hat Lightspeed component uses Lodash in pcs-web-ui, which is vulnerable unless mitigated. RHEL 8.10 excludes pcs-web-ui and is not affected. The vulnerability is rated with important severity due to denial of service impact.

CWE-1321Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (opens in a new tab)
Variant weakness
The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Implementation
By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Architecture and Design
By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Implementation · Input Validation
When handling untrusted objects, validating using a schema can be used.
OWASP Cheat Sheets
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V5.1.2 (opens in a new tab)
Attack patterns
Accessing Functionality Not Properly Constrained by ACLs (opens in a new tab)
Exploiting Incorrectly Configured Access Control Security Levels (opens in a new tab)
Manipulating User-Controlled Variables (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 1 Nov 2026, 06:38 UTC

Public exploits and detectionGitHub proofs of concept

WeaknessesCWE-1321

Technical details

References

Community reviews

Related threats