What CVE-2025-13465 Teaches Us About Prototype Pollution in JavaScript

CVE-2025-13465 is a prototype pollution vulnerability in Lodash that illustrates why not all prototype pollution issues are created equal. Rather than stemming from a generic misuse of __proto__, this vulnerability emerged from a specific API behavior and the assumptions built around it. By walking through the underlying problem, a practical proof of concept, and the reasoning behind a non-generic…