Current behavior
Existing installations of Cypress report a moderate severity vulnerability CVE-2025-13465 (GHSA-xxjr-mmjv-4gpg) in lodash@4.17.21.
Desired behavior
Update lodash to minimum 4.17.23 in a future release of Cypress to remediate the vulnerability without requiring npm audit fix, reinstall or other workarounds.
Test code to reproduce
git clone https://github.com/cypress-io/github-action
cd github-action
cd examples/basic
npm ci
npm audit
Cypress Version
15.9.0
Debug Logs
$ npm audit
# npm audit report
lodash 4.0.0 - 4.17.21
Severity: moderate
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - https://github.com/advisories/GHSA-xxjr-mmjv-4gpg
fix available via `npm audit fix`
node_modules/lodash
1 moderate severity vulnerability
To address all issues, run:
npm audit fix
Other
No response
Current behavior
Existing installations of Cypress report a moderate severity vulnerability CVE-2025-13465 (GHSA-xxjr-mmjv-4gpg) in lodash@4.17.21.
Desired behavior
Update lodash to minimum
4.17.23in a future release of Cypress to remediate the vulnerability without requiringnpm audit fix, reinstall or other workarounds.Test code to reproduce
Cypress Version
15.9.0Debug Logs
Other
No response