CVE-2025-13465 is a prototype pollution vulnerability in lodash's _.unset and _.omit functions. An attacker able to control the property path argument can delete properties from global prototypes, leading to denial of service by removing critical functionality. The vulnerability does not allow overwriting behavior, limiting impact to denial of service only. It affects applications that use these lodash functions on objects with user input determining the property path. Red Hat's affected products include Red Hat OpenShift Container Platform 4.20 and others that bundle the vulnerable lodash version. Red Hat Enterprise Linux 8.10 and later are not affected as they no longer include the vulnerable lodash component in PCS. The vulnerability has been rated with important severity by Red Hat, with a CVSS base score of 8.2 by cve.org but availability impact is considered high only by Red Hat due to denial of service potential. Mitigation requires strict input validation to block prototype chain access strings such as __proto__, constructor, and prototype.

The vulnerability allows denial of service by deleting methods from global prototypes via prototype pollution. This can cause loss of functionality or crashes in affected applications. There is no confidentiality or integrity impact. The issue is exploitable only if user input controls the property path passed to _.unset or _.omit. Red Hat rates the severity as important/high due to denial of service impact. Red Hat Enterprise Linux 8.10 and later are not affected as the vulnerable lodash component is not included in PCS. The impact is limited to denial of service, not arbitrary code execution or data disclosure.

Red Hat has issued security advisories and updates addressing this vulnerability in affected products. To mitigate, implement strict input validation to block user input that attempts to access prototype chain properties such as __proto__, constructor, and prototype before passing property paths to _.unset and _.omit functions. Red Hat Enterprise Linux 8.10 and later are not affected. Users should apply the official Red Hat updates for their affected products as provided in the Red Hat security advisories. No additional action is required if running unaffected versions or products without the vulnerable lodash component.