{"bom":{"annotations":[{"annotator":{"component":{"authors":[{"name":"OWASP Foundation"}],"bom-ref":"pkg:npm/@cdxgen/cdxgen@13.3.0","group":"@cdxgen","name":"cdxgen","publisher":"OWASP Foundation","purl":"pkg:npm/%40cdxgen/cdxgen@13.3.0","type":"application","version":"13.3.0"}},"bom-ref":"metadata-annotations","subjects":["pkg:npm/vuln-pinned@1.0.0"],"text":"This Software Bill-of-Materials (SBOM) document was created on Wednesday, October 14, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'vuln-pinned' with version '1.0.0'.","timestamp":"2026-10-14T22:56:51Z"}],"bomFormat":"CycloneDX","components":[{"bom-ref":"pkg:npm/lodash@4.17.15","description":"Lodash modular utilities.","evidence":{"identity":[{"concludedValue":"package-lock.json","confidence":1,"field":"purl","methods":[{"confidence":1,"technique":"manifest-analysis","value":"package-lock.json"}]}]},"externalReferences":[{"type":"distribution","url":"https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz"}],"group":"","hashes":[{"alg":"SHA-512","content":"f3139c447bc28e7a1c752e5ca705d05d5ce69a1e5ee7eb1a136406a1e4266ca9914ba277550a693ce22dd0c9e613ee31959a2e9b2d063c6d03d0c54841b340d4"}],"licenses":[{"license":{"id":"MIT","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:license:foss","value":"true"},{"name":"cdx:license:osiApproved","value":"true"},{"name":"cdx:license:fsfLibre","value":"true"},{"name":"cdx:license:deprecated","value":"false"}],"url":"https://opensource.org/licenses/MIT"}}],"name":"lodash","properties":[{"name":"cdx:license:category","value":"Permissive"},{"name":"cdx:npm:artifactIntegrity","value":"sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A=="},{"name":"cdx:npm:artifactShasum","value":"b447f6670a0455bbfeedd11392eff330ea097548"},{"name":"cdx:npm:lastModifiedTime","value":"2026-10-14T00:52:55.519Z"},{"name":"cdx:npm:maintainerOverlapCount","value":"4"},{"name":"cdx:npm:maintainerOverlapRatio","value":"1.00"},{"name":"cdx:npm:maintainerSet","value":"jdalton, john.david.dalton@gmail.com, mathias, mathias@qiwi.be"},{"name":"cdx:npm:maintainerSetCount","value":"4"},{"name":"cdx:npm:packageCreatedTime","value":"2012-04-23T16:37:11.912Z"},{"name":"cdx:npm:priorMaintainerSet","value":"jdalton, john.david.dalton@gmail.com, mathias, mathias@qiwi.be"},{"name":"cdx:npm:priorMaintainerSetCount","value":"4"},{"name":"cdx:npm:priorPublishTime","value":"2019-07-10T15:44:39.173Z"},{"name":"cdx:npm:priorPublisher","value":"jdalton"},{"name":"cdx:npm:priorVersion","value":"4.17.14"},{"name":"cdx:npm:publishTime","value":"2019-07-19T02:28:46.584Z"},{"name":"cdx:npm:publisher","value":"jdalton"},{"name":"cdx:npm:publisherEmail","value":"john.david.dalton@gmail.com"},{"name":"cdx:npm:releaseCadenceCompressionRatio","value":"1.78"},{"name":"cdx:npm:releaseGapBaselineDays","value":"4.74"},{"name":"cdx:npm:releaseGapDays","value":"8.45"},{"name":"cdx:npm:releaseGapSampleSize","value":"106"},{"name":"cdx:npm:versionCount","value":"117"},{"name":"internal:LocalNodeModulesPath","value":"node_modules/lodash"},{"name":"internal:ResolvedUrl","value":"https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz"},{"name":"internal:SrcFile","value":"package-lock.json"},{"name":"bomlens:licenseClass","value":"permissive"}],"purl":"pkg:npm/lodash@4.17.15","type":"library","version":"4.17.15"}],"dependencies":[{"dependsOn":[],"ref":"pkg:npm/lodash@4.17.15"},{"dependsOn":["pkg:npm/lodash@4.17.15"],"ref":"pkg:npm/vuln-pinned@1.0.0"}],"metadata":{"component":{"bom-ref":"pkg:npm/vuln-pinned@1.0.0","description":"SCA 벤치마크 fixture — 취약 버전 고정으로 취약점 precision 측정","group":"","name":"npm-vuln-pinned","properties":[{"name":"bomlens:source:versionPinning","value":"pinned"}],"type":"application","version":"1.0.0"},"lifecycles":[{"phase":"pre-build"}],"properties":[{"name":"cdx:bom:componentSrcFiles","value":"package-lock.json"},{"name":"cdx:bom:componentTypes","value":"npm"},{"name":"bomlens:prep-step-applied","value":"npm-production-set"},{"name":"bomlens:excluded-paths","value":"**/test/**, **/tests/**, **/spec/**, **/fixtures/**, **/testdata/**, **/__tests__/**, **/e2e/**, **/example/**, **/examples/**, **/sample/**, **/samples/**, **/bench/**, **/benches/**, **/benchmark/**, **/benchmarks/**, **/demo/**, **/demos/**, **/playground/**, **/.github/workflows/**, **/gradle/wrapper/**"},{"name":"bomlens:undeclared-fields","value":"unknown-to-author"}],"timestamp":"2026-10-14T22:56:51Z","tools":{"components":[{"authors":[{"name":"OWASP Foundation"}],"bom-ref":"pkg:npm/@cdxgen/cdxgen@13.3.0","group":"@cdxgen","name":"cdxgen","publisher":"OWASP Foundation","purl":"pkg:npm/%40cdxgen/cdxgen@13.3.0","type":"application","version":"13.3.0"},{"name":"BomLens","publisher":"SK Telecom","type":"application","version":"1.13.4"}]}},"serialNumber":"urn:uuid:6051465f-262f-421e-a071-54322dd738da","services":[],"specVersion":"1.6","version":1,"compositions":[{"aggregate":"unknown"}]},"security":{"SchemaVersion":2,"Trivy":{"Version":"0.75.0"},"ReportID":"01a13ca2-6bd0-735c-aad8-157b57dcdf93","CreatedAt":"2026-10-14T22:57:19.824222571Z","ArtifactName":"npm-vuln-pinned_1.0.0_bom.json","ArtifactType":"cyclonedx","Results":[{"Target":"Node.js","Class":"lang-pkgs","Type":"node-pkg","Packages":[{"ID":"lodash@4.17.15","Name":"lodash","Identifier":{"PURL":"pkg:npm/lodash@4.17.15","UID":"32e1f921cfc50980","BOMRef":"pkg:npm/lodash@4.17.15"},"Version":"4.17.15","Licenses":["MIT"],"Digest":"sha512:f3139c447bc28e7a1c752e5ca705d05d5ce69a1e5ee7eb1a136406a1e4266ca9914ba277550a693ce22dd0c9e613ee31959a2e9b2d063c6d03d0c54841b340d4"}],"Vulnerabilities":[{"VulnerabilityID":"CVE-2020-8203","VendorIDs":["GHSA-p6mc-m468-83gw"],"PkgID":"lodash@4.17.15","PkgName":"lodash","PkgIdentifier":{"PURL":"pkg:npm/lodash@4.17.15","UID":"32e1f921cfc50980","BOMRef":"pkg:npm/lodash@4.17.15"},"InstalledVersion":"4.17.15","FixedVersion":"4.17.19","Status":"fixed","SeveritySource":"ghsa","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2020-8203","DataSource":{"ID":"ghsa","Name":"GitHub Security Advisory npm","URL":"https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm"},"Fingerprint":"sha256:654eb32df008bc6b5d55792382b93f26893aad5b532b36905136a36f621721c7","Title":"nodejs-lodash: prototype pollution in zipObjectDeep function","Description":"Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.","Severity":"HIGH","CweIDs":["CWE-770","CWE-1321"],"VendorSeverity":{"ghsa":3,"nvd":3,"redhat":2,"ruby-advisory-db":3,"ubuntu":2},"CVSS":{"ghsa":{"V3Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","V3Score":7.4},"nvd":{"V2Vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","V3Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","V2Score":5.8,"V3Score":7.4},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","V3Score":7.4}},"References":["https://access.redhat.com/security/cve/CVE-2020-8203","https://github.com/advisories/GHSA-p6mc-m468-83gw","https://github.com/github/advisory-database/pull/2884","https://github.com/lodash/lodash","https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12","https://github.com/lodash/lodash/issues/4744","https://github.com/lodash/lodash/issues/4874","https://github.com/lodash/lodash/wiki/Changelog#v41719","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml","https://hackerone.com/reports/712065","https://hackerone.com/reports/864701","https://nvd.nist.gov/vuln/detail/CVE-2020-8203","https://security.netapp.com/advisory/ntap-20200724-0006","https://security.netapp.com/advisory/ntap-20200724-0006/","https://ubuntu.com/security/notices/USN-8411-1","https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744","https://www.cve.org/CVERecord?id=CVE-2020-8203","https://www.npmjs.com/advisories/1523","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"PublishedDate":"2020-07-15T17:15:11.797Z","LastModifiedDate":"2026-06-17T03:26:02.917Z"},{"VulnerabilityID":"CVE-2021-23337","VendorIDs":["GHSA-35jh-r3h4-6jhm"],"PkgID":"lodash@4.17.15","PkgName":"lodash","PkgIdentifier":{"PURL":"pkg:npm/lodash@4.17.15","UID":"32e1f921cfc50980","BOMRef":"pkg:npm/lodash@4.17.15"},"InstalledVersion":"4.17.15","FixedVersion":"4.17.21","Status":"fixed","SeveritySource":"ghsa","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2021-23337","DataSource":{"ID":"ghsa","Name":"GitHub Security Advisory npm","URL":"https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm"},"Fingerprint":"sha256:e6fbdfd5861000dbe9ba4ea2e8f3d6751ac0cbbcbae49c811ff1d07b3833394d","Title":"nodejs-lodash: command injection via template","Description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","Severity":"HIGH","CweIDs":["CWE-94"],"VendorSeverity":{"ghsa":3,"nvd":3,"redhat":2,"ruby-advisory-db":3,"ubuntu":2},"CVSS":{"ghsa":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","V3Score":7.2},"nvd":{"V2Vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","V3Vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","V2Score":6.5,"V3Score":7.2},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","V3Score":7.2}},"References":["https://access.redhat.com/security/cve/CVE-2021-23337","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/advisories/GHSA-35jh-r3h4-6jhm","https://github.com/lodash/lodash","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml","https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://security.netapp.com/advisory/ntap-20210312-0006","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://ubuntu.com/security/notices/USN-8411-1","https://www.cve.org/CVERecord?id=CVE-2021-23337","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"PublishedDate":"2021-02-15T13:15:12.56Z","LastModifiedDate":"2026-10-08T22:17:07.363Z"},{"VulnerabilityID":"CVE-2026-4800","VendorIDs":["GHSA-r5fr-rjxr-66jc"],"PkgID":"lodash@4.17.15","PkgName":"lodash","PkgIdentifier":{"PURL":"pkg:npm/lodash@4.17.15","UID":"32e1f921cfc50980","BOMRef":"pkg:npm/lodash@4.17.15"},"InstalledVersion":"4.17.15","FixedVersion":"4.18.0","Status":"fixed","SeveritySource":"ghsa","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-4800","DataSource":{"ID":"ghsa","Name":"GitHub Security Advisory npm","URL":"https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm"},"Fingerprint":"sha256:0747e1b11504e4a56b55cd2762c3089f3f700e750aa6efcbc114c3d3810ae716","Title":"lodash: lodash: Arbitrary code execution via untrusted input in template imports","Description":"Impact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().\n\nPatches:\n\nUsers should upgrade to version 4.18.0.\n\nWorkarounds:\n\nDo not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.","Severity":"HIGH","CweIDs":["CWE-94"],"VendorSeverity":{"alma":3,"ghsa":3,"nvd":4,"oracle-oval":3,"redhat":3,"rocky":3,"ubuntu":2},"CVSS":{"ghsa":{"V3Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","V3Score":8.1},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","V3Score":9.8},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","V3Score":8.1}},"References":["https://access.redhat.com/errata/RHBA-2026:21387","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10710","https://access.redhat.com/errata/RHSA-2026:10713","https://access.redhat.com/errata/RHSA-2026:11454","https://access.redhat.com/errata/RHSA-2026:11469","https://access.redhat.com/errata/RHSA-2026:11470","https://access.redhat.com/errata/RHSA-2026:11471","https://access.redhat.com/errata/RHSA-2026:11493","https://access.redhat.com/errata/RHSA-2026:11494","https://access.redhat.com/errata/RHSA-2026:11495","https://access.redhat.com/errata/RHSA-2026:11516","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13553","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17549","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:19008","https://access.redhat.com/errata/RHSA-2026:19167","https://access.redhat.com/errata/RHSA-2026:19409","https://access.redhat.com/errata/RHSA-2026:19410","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8498","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-4800","https://advisory.echohq.com/cve/CVE-2026-4800","https://bugzilla.redhat.com/2453496","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://bugzilla.redhat.com/show_bug.cgi?id=2453496","https://cna.openjsf.org/security-advisories.html","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13465","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4800","https://errata.almalinux.org/9/ALSA-2026-19167.html","https://errata.rockylinux.org/RLSA-2026:24331","https://github.com/advisories/GHSA-35jh-r3h4-6jhm","https://github.com/advisories/GHSA-r5fr-rjxr-66jc","https://github.com/lodash/lodash","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://linux.oracle.com/cve/CVE-2026-4800.html","https://linux.oracle.com/errata/ELSA-2026-24331.html","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json","https://ubuntu.com/security/notices/USN-8411-1","https://www.cve.org/CVERecord?id=CVE-2026-4800"],"PublishedDate":"2026-03-31T20:16:29.66Z","LastModifiedDate":"2026-09-10T13:20:23.21Z"},{"VulnerabilityID":"NSWG-ECO-516","PkgID":"lodash@4.17.15","PkgName":"lodash","PkgIdentifier":{"PURL":"pkg:npm/lodash@4.17.15","UID":"32e1f921cfc50980","BOMRef":"pkg:npm/lodash@4.17.15"},"InstalledVersion":"4.17.15","FixedVersion":">=4.17.19","Status":"fixed","SeveritySource":"nodejs-security-wg","PrimaryURL":"https://www.npmjs.com/advisories/1523","DataSource":{"ID":"nodejs-security-wg","Name":"Node.js Ecosystem Security Working Group","URL":"https://github.com/nodejs/security-wg"},"Fingerprint":"sha256:4d8d5c632ddf5a3d495cf5406586e680b0ae5161860c91d0f72907073871f5e7","Title":"Allocation of Resources Without Limits or Throttling","Description":"Prototype pollution attack (lodash)","Severity":"HIGH","VendorSeverity":{"nodejs-security-wg":3},"References":["https://github.com/lodash/lodash/pull/4759","https://hackerone.com/reports/712065","https://www.npmjs.com/advisories/1523"]},{"VulnerabilityID":"CVE-2020-28500","VendorIDs":["GHSA-29mw-wpgm-hmr9"],"PkgID":"lodash@4.17.15","PkgName":"lodash","PkgIdentifier":{"PURL":"pkg:npm/lodash@4.17.15","UID":"32e1f921cfc50980","BOMRef":"pkg:npm/lodash@4.17.15"},"InstalledVersion":"4.17.15","FixedVersion":"4.17.21","Status":"fixed","SeveritySource":"ghsa","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2020-28500","DataSource":{"ID":"ghsa","Name":"GitHub Security Advisory npm","URL":"https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm"},"Fingerprint":"sha256:da808289ac4db3ba14b8224d03afe3b8935891cee6703177e04490628f1a66c8","Title":"nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions","Description":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","Severity":"MEDIUM","VendorSeverity":{"ghsa":2,"nvd":2,"redhat":2,"ruby-advisory-db":2,"ubuntu":2},"CVSS":{"ghsa":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","V3Score":5.3},"nvd":{"V2Vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","V2Score":5,"V3Score":5.3},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","V3Score":5.3}},"References":["https://access.redhat.com/security/cve/CVE-2020-28500","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/advisories/GHSA-29mw-wpgm-hmr9","https://github.com/github/advisory-database/pull/6139","https://github.com/lodash/lodash","https://github.com/lodash/lodash/blob/npm/trimEnd.js","https://github.com/lodash/lodash/blob/npm/trimEnd.js#L8","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a","https://github.com/lodash/lodash/pull/5065","https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-28500.yml","https://nvd.nist.gov/vuln/detail/CVE-2020-28500","https://security.netapp.com/advisory/ntap-20210312-0006","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://ubuntu.com/security/notices/USN-8411-1","https://www.cve.org/CVERecord?id=CVE-2020-28500","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"PublishedDate":"2021-02-15T11:15:12.397Z","LastModifiedDate":"2026-10-08T22:16:59.333Z"},{"VulnerabilityID":"CVE-2025-13465","VendorIDs":["GHSA-xxjr-mmjv-4gpg"],"PkgID":"lodash@4.17.15","PkgName":"lodash","PkgIdentifier":{"PURL":"pkg:npm/lodash@4.17.15","UID":"32e1f921cfc50980","BOMRef":"pkg:npm/lodash@4.17.15"},"InstalledVersion":"4.17.15","FixedVersion":"4.17.23","Status":"fixed","SeveritySource":"ghsa","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2025-13465","DataSource":{"ID":"ghsa","Name":"GitHub Security Advisory npm","URL":"https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm"},"Fingerprint":"sha256:3df9f2011c006a7a755ea3646867ed50d69b03c0f14092c00d9f1f89e2609526","Title":"lodash: prototype pollution in _.unset and _.omit functions","Description":"Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23","Severity":"MEDIUM","CweIDs":["CWE-1321"],"VendorSeverity":{"alma":3,"ghsa":2,"nvd":2,"oracle-oval":3,"redhat":3,"rocky":3,"ubuntu":2},"CVSS":{"ghsa":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","V40Vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","V3Score":6.5,"V40Score":6.9},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","V3Score":5.3},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","V3Score":8.2}},"References":["https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:1845","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:2078","https://access.redhat.com/errata/RHSA-2026:2119","https://access.redhat.com/errata/RHSA-2026:2145","https://access.redhat.com/errata/RHSA-2026:2147","https://access.redhat.com/errata/RHSA-2026:2148","https://access.redhat.com/errata/RHSA-2026:2149","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:2438","https://access.redhat.com/errata/RHSA-2026:2452","https://access.redhat.com/errata/RHSA-2026:2462","https://access.redhat.com/errata/RHSA-2026:2465","https://access.redhat.com/errata/RHSA-2026:2469","https://access.redhat.com/errata/RHSA-2026:2484","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:2651","https://access.redhat.com/errata/RHSA-2026:2661","https://access.redhat.com/errata/RHSA-2026:2672","https://access.redhat.com/errata/RHSA-2026:2675","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:2816","https://access.redhat.com/errata/RHSA-2026:2817","https://access.redhat.com/errata/RHSA-2026:2818","https://access.redhat.com/errata/RHSA-2026:2819","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:2984","https://access.redhat.com/errata/RHSA-2026:2990","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:3422","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3710","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3825","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3870","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3962","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:4423","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4630","https://access.redhat.com/errata/RHSA-2026:4782","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6288","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-13465","https://advisory.echohq.com/cve/CVE-2025-13465","https://bugzilla.redhat.com/2431740","https://bugzilla.redhat.com/show_bug.cgi?id=2425946","https://bugzilla.redhat.com/show_bug.cgi?id=2430538","https://bugzilla.redhat.com/show_bug.cgi?id=2431036","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://bugzilla.redhat.com/show_bug.cgi?id=2433645","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://creativecommons.org/licenses/by/4.0/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13465","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-15284","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23745","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23950","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24842","https://errata.almalinux.org/9/ALSA-2026-2452.html","https://errata.rockylinux.org/RLSA-2026:18868","https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","https://github.com/lodash/lodash","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://linux.oracle.com/cve/CVE-2025-13465.html","https://linux.oracle.com/errata/ELSA-2026-2452.html","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json","https://ubuntu.com/security/notices/USN-8411-1","https://www.cve.org/CVERecord?id=CVE-2025-13465"],"PublishedDate":"2026-01-21T20:16:05.25Z","LastModifiedDate":"2026-09-10T13:16:56.537Z"},{"VulnerabilityID":"CVE-2026-2950","VendorIDs":["GHSA-f23m-r3pf-42rh"],"PkgID":"lodash@4.17.15","PkgName":"lodash","PkgIdentifier":{"PURL":"pkg:npm/lodash@4.17.15","UID":"32e1f921cfc50980","BOMRef":"pkg:npm/lodash@4.17.15"},"InstalledVersion":"4.17.15","FixedVersion":"4.18.0","Status":"fixed","SeveritySource":"ghsa","PrimaryURL":"https://avd.aquasec.com/nvd/cve-2026-2950","DataSource":{"ID":"ghsa","Name":"GitHub Security Advisory npm","URL":"https://github.com/advisories?query=type%3Areviewed+ecosystem%3Anpm"},"Fingerprint":"sha256:8e12628913c6061dffdc70c89a1088e6164f7a5c5ce0142f056da88f9ed48878","Title":"lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass","Description":"Impact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\nPatches:\n\nThis issue is patched in 4.18.0.\n\nWorkarounds:\n\nNone. Upgrade to the patched version.","Severity":"MEDIUM","CweIDs":["CWE-1321"],"VendorSeverity":{"ghsa":2,"nvd":2,"redhat":2,"ubuntu":2},"CVSS":{"ghsa":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","V3Score":6.5},"nvd":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","V3Score":5.3},"redhat":{"V3Vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","V3Score":6.5}},"References":["https://access.redhat.com/security/cve/CVE-2026-2950","https://advisory.echohq.com/cve/CVE-2026-2950","https://github.com/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash","https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950","https://ubuntu.com/security/notices/USN-8411-1","https://www.cve.org/CVERecord?id=CVE-2026-2950"],"PublishedDate":"2026-03-31T20:16:26.207Z","LastModifiedDate":"2026-07-24T20:10:00.147Z"}]}],"UncheckedComponents":{"Count":0,"Components":[]}},"scancode":{"headers":[{"tool_name":"scancode-toolkit","tool_version":"32.5.0","options":{"input":["/src"],"--ignore":["node_modules","vendor","bower_components",".venv","venv","virtualenv","site-packages","dist","build","target","out",".next",".nuxt","__pycache__",".gradle",".git",".hg",".svn",".tox",".mypy_cache",".pytest_cache",".ruff_cache",".idea",".vscode","npm-vuln-pinned_1.0.0"],"--json-pp":"/tmp/bomlens-scancode.3ulFBk","--license":true,"--only-findings":false,"--strip-root":true},"notice":"Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.","start_timestamp":"2026-10-14T225700.923349","end_timestamp":"2026-10-14T225703.427379","output_format_version":"4.1.0","duration":2.5040390491485596,"message":null,"errors":[],"warnings":[],"extra_data":{"system_environment":{"operating_system":"linux","cpu_architecture":"64","platform":"Linux-6.8.0-100-generic-aarch64-with-glibc2.41","platform_version":"#100-Ubuntu SMP PREEMPT_DYNAMIC Tue Jan 13 16:39:21 UTC 2026","python_version":"3.12.14 (main, Sep 19 2026, 01:11:14) [GCC 14.2.0]"},"spdx_license_list_version":"3.27","files_count":2}}],"license_detections":[],"files":[{"path":"package-lock.json","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]},{"path":"package.json","type":"file","detected_license_expression":null,"detected_license_expression_spdx":null,"license_detections":[],"license_clues":[],"percentage_of_license_text":0,"scan_errors":[]}]}}