{"matches":[{"vulnerability":{"id":"GHSA-35jh-r3h4-6jhm","dataSource":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml"],"description":"Command Injection in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97554,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2021-05-07","kind":"first-observed"}]},"advisories":[],"risk":15.679754999999998},"relatedVulnerabilities":[{"id":"CVE-2021-23337","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.21333,"percentile":0.97554,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.15"}},"found":{"vulnerabilityID":"GHSA-35jh-r3h4-6jhm","versionConstraint":"<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"0b98b707a64f3042","name":"lodash","version":"4.17.15","type":"npm","locations":[{"path":"/package-lock.json","accessPath":"/package-lock.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-p6mc-m468-83gw","dataSource":"https://github.com/advisories/GHSA-p6mc-m468-83gw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/issues/4744","https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12","https://nvd.nist.gov/vuln/detail/CVE-2020-8203","https://hackerone.com/reports/712065","https://github.com/lodash/lodash/issues/4874","https://github.com/github/advisory-database/pull/2884","https://hackerone.com/reports/864701","https://github.com/lodash/lodash/wiki/Changelog#v41719","https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744","https://security.netapp.com/advisory/ntap-20200724-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.05213,"percentile":0.92316,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.19"],"state":"fixed","available":[{"version":"4.17.19","date":"2020-07-28","kind":"first-observed"}]},"advisories":[],"risk":3.883685},"relatedVulnerabilities":[{"id":"CVE-2020-8203","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8203","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/lodash/lodash/issues/4874","https://hackerone.com/reports/712065","https://security.netapp.com/advisory/ntap-20200724-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.05213,"percentile":0.92316,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.15"}},"found":{"vulnerabilityID":"GHSA-p6mc-m468-83gw","versionConstraint":">=3.7.0,<4.17.19 (semantic)"},"fix":{"suggestedVersion":"4.17.19"}}],"artifact":{"id":"0b98b707a64f3042","name":"lodash","version":"4.17.15","type":"npm","locations":[{"path":"/package-lock.json","accessPath":"/package-lock.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-29mw-wpgm-hmr9","dataSource":"https://github.com/advisories/GHSA-29mw-wpgm-hmr9","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2020-28500","https://github.com/lodash/lodash/pull/5065","https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-28500.yml","https://github.com/github/advisory-database/pull/6139"],"description":"Regular Expression Denial of Service (ReDoS) in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28500","epss":0.07336,"percentile":0.94263,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2020-28500","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2022-01-07","kind":"first-observed"}]},"advisories":[],"risk":3.77804},"relatedVulnerabilities":[{"id":"CVE-2020-28500","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-28500","namespace":"nvd:cpe","severity":"Medium","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash/pull/5065","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-28500","epss":0.07336,"percentile":0.94263,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2020-28500","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.15"}},"found":{"vulnerabilityID":"GHSA-29mw-wpgm-hmr9","versionConstraint":">=4.0.0,<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"0b98b707a64f3042","name":"lodash","version":"4.17.15","type":"npm","locations":[{"path":"/package-lock.json","accessPath":"/package-lock.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-r5fr-rjxr-66jc","dataSource":"https://github.com/advisories/GHSA-r5fr-rjxr-66jc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-35jh-r3h4-6jhm"],"description":"lodash vulnerable to Code Injection via `_.template` imports key names","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02618,"percentile":0.85043,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":2.0420399999999996},"relatedVulnerabilities":[{"id":"CVE-2026-4800","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800","namespace":"nvd:cpe","severity":"Critical","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/advisories/GHSA-35jh-r3h4-6jhm","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://access.redhat.com/errata/RHBA-2026:21387","https://access.redhat.com/errata/RHSA-2026:10131","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10710","https://access.redhat.com/errata/RHSA-2026:10713","https://access.redhat.com/errata/RHSA-2026:11454","https://access.redhat.com/errata/RHSA-2026:11469","https://access.redhat.com/errata/RHSA-2026:11470","https://access.redhat.com/errata/RHSA-2026:11471","https://access.redhat.com/errata/RHSA-2026:11493","https://access.redhat.com/errata/RHSA-2026:11494","https://access.redhat.com/errata/RHSA-2026:11495","https://access.redhat.com/errata/RHSA-2026:11516","https://access.redhat.com/errata/RHSA-2026:12277","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13553","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:17448","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:17547","https://access.redhat.com/errata/RHSA-2026:17549","https://access.redhat.com/errata/RHSA-2026:17550","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:17789","https://access.redhat.com/errata/RHSA-2026:19008","https://access.redhat.com/errata/RHSA-2026:19167","https://access.redhat.com/errata/RHSA-2026:19409","https://access.redhat.com/errata/RHSA-2026:19410","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20943","https://access.redhat.com/errata/RHSA-2026:20946","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:22619","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:29795","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36621","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:37186","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40795","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:44235","https://access.redhat.com/errata/RHSA-2026:48699","https://access.redhat.com/errata/RHSA-2026:54188","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8498","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/security/cve/CVE-2026-4800","https://bugzilla.redhat.com/show_bug.cgi?id=2453496","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"],"description":"Impact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().\n\nPatches:\n\nUsers should upgrade to version 4.18.0.\n\nWorkarounds:\n\nDo not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-4800","epss":0.02618,"percentile":0.85043,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2026-4800","cwe":"CWE-94","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.15"}},"found":{"vulnerabilityID":"GHSA-r5fr-rjxr-66jc","versionConstraint":">=4.0.0,<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"0b98b707a64f3042","name":"lodash","version":"4.17.15","type":"npm","locations":[{"path":"/package-lock.json","accessPath":"/package-lock.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-xxjr-mmjv-4gpg","dataSource":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.0185,"percentile":0.78526,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}],"fix":{"versions":["4.17.23"],"state":"fixed","available":[{"version":"4.17.23","date":"2026-01-22","kind":"first-observed"}]},"advisories":[],"risk":1.08225},"relatedVulnerabilities":[{"id":"CVE-2025-13465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14870","https://access.redhat.com/errata/RHSA-2026:14871","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:17469","https://access.redhat.com/errata/RHSA-2026:1845","https://access.redhat.com/errata/RHSA-2026:18480","https://access.redhat.com/errata/RHSA-2026:18868","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20042","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:2078","https://access.redhat.com/errata/RHSA-2026:2119","https://access.redhat.com/errata/RHSA-2026:2145","https://access.redhat.com/errata/RHSA-2026:2147","https://access.redhat.com/errata/RHSA-2026:2148","https://access.redhat.com/errata/RHSA-2026:2149","https://access.redhat.com/errata/RHSA-2026:21658","https://access.redhat.com/errata/RHSA-2026:24331","https://access.redhat.com/errata/RHSA-2026:2438","https://access.redhat.com/errata/RHSA-2026:2452","https://access.redhat.com/errata/RHSA-2026:2462","https://access.redhat.com/errata/RHSA-2026:2465","https://access.redhat.com/errata/RHSA-2026:2469","https://access.redhat.com/errata/RHSA-2026:2484","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:2651","https://access.redhat.com/errata/RHSA-2026:2661","https://access.redhat.com/errata/RHSA-2026:2672","https://access.redhat.com/errata/RHSA-2026:2675","https://access.redhat.com/errata/RHSA-2026:2694","https://access.redhat.com/errata/RHSA-2026:2816","https://access.redhat.com/errata/RHSA-2026:2817","https://access.redhat.com/errata/RHSA-2026:2818","https://access.redhat.com/errata/RHSA-2026:2819","https://access.redhat.com/errata/RHSA-2026:2900","https://access.redhat.com/errata/RHSA-2026:2926","https://access.redhat.com/errata/RHSA-2026:2984","https://access.redhat.com/errata/RHSA-2026:2990","https://access.redhat.com/errata/RHSA-2026:3087","https://access.redhat.com/errata/RHSA-2026:33154","https://access.redhat.com/errata/RHSA-2026:33371","https://access.redhat.com/errata/RHSA-2026:34100","https://access.redhat.com/errata/RHSA-2026:3422","https://access.redhat.com/errata/RHSA-2026:34608","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3710","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3825","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3870","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3962","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:40984","https://access.redhat.com/errata/RHSA-2026:41064","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:41944","https://access.redhat.com/errata/RHSA-2026:4423","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4630","https://access.redhat.com/errata/RHSA-2026:4782","https://access.redhat.com/errata/RHSA-2026:5633","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6288","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-13465","https://bugzilla.redhat.com/show_bug.cgi?id=2431740","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-13465.json"],"description":"Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"exploitabilityScore":3.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.0185,"percentile":0.78526,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"},{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.15"}},"found":{"vulnerabilityID":"GHSA-xxjr-mmjv-4gpg","versionConstraint":">=4.0.0,<=4.17.22 (semantic)"},"fix":{"suggestedVersion":"4.17.23"}}],"artifact":{"id":"0b98b707a64f3042","name":"lodash","version":"4.17.15","type":"npm","locations":[{"path":"/package-lock.json","accessPath":"/package-lock.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-f23m-r3pf-42rh","dataSource":"https://github.com/advisories/GHSA-f23m-r3pf-42rh","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950"],"description":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00377,"percentile":0.29729,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.18.0"],"state":"fixed","available":[{"version":"4.18.0","date":"2026-04-02","kind":"first-observed"}]},"advisories":[],"risk":0.216775},"relatedVulnerabilities":[{"id":"CVE-2026-2950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"],"description":"Impact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\nPatches:\n\nThis issue is patched in 4.18.0.\n\nWorkarounds:\n\nNone. Upgrade to the patched version.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2950","epss":0.00377,"percentile":0.29729,"date":"2026-10-12"}],"cwes":[{"cve":"CVE-2026-2950","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.15"}},"found":{"vulnerabilityID":"GHSA-f23m-r3pf-42rh","versionConstraint":"<=4.17.23 (semantic)"},"fix":{"suggestedVersion":"4.18.0"}}],"artifact":{"id":"0b98b707a64f3042","name":"lodash","version":"4.17.15","type":"npm","locations":[{"path":"/package-lock.json","accessPath":"/package-lock.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":[],"cpes":["cpe:2.3:a:lodash:lodash:4.17.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.15","upstreams":[]}}],"source":{"type":"directory","target":"~/projects/sca-benchmark-wt/refresh-latest/fixtures/npm-vuln-pinned"},"distro":{"name":"","version":"","idLike":null},"descriptor":{"name":"grype","version":"0.120.1","configuration":{"output":["json"],"file":"","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"~/projects/sca-benchmark/.vuln-db-2026-10-14/grype","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":false,"validate-by-hash-on-start":true,"validate-age":false,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-10-12T00:41:00Z_1791873320.tar.zst?checksum=sha256%3Aed50c6deedbbe39f815f855fb55208a1f261ebec6a91d2847b1230200bbb7b20","built":"2026-10-13T06:35:20Z","path":"~/projects/sca-benchmark/.vuln-db-2026-10-14/grype/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-10-13T00:39:19Z","input":"xxh64:ec91471f53bafece"},"alpine":{"captured":"2026-10-13T00:39:00Z","input":"xxh64:4e34647efc080919"},"amazon":{"captured":"2026-10-13T00:38:59Z","input":"xxh64:1d440a6fe12cb43e"},"arch":{"captured":"2026-10-13T00:39:07Z","input":"xxh64:be7ff0877c49ab37"},"bitnami":{"captured":"2026-10-13T00:40:02Z","input":"xxh64:de70095674b0bd6a"},"chainguard":{"captured":"2026-10-13T00:39:08Z","input":"xxh64:e2fcc4ecd019f0c3"},"chainguard-libraries":{"captured":"2026-10-13T00:39:12Z","input":"xxh64:2312587aba5f9dbe"},"debian":{"captured":"2026-10-13T00:39:21Z","input":"xxh64:c1c6eed2be2f8542"},"echo":{"captured":"2026-10-13T00:38:53Z","input":"xxh64:678684d41e38a999"},"eol":{"captured":"2026-10-13T00:39:01Z","input":"xxh64:a4f625880b41a599"},"epss":{"captured":"2026-10-13T00:38:57Z","input":"xxh64:a3f29536c4fb718b"},"fedora":{"captured":"2026-10-13T00:39:04Z","input":"xxh64:bca8272bceea3610"},"github":{"captured":"2026-10-13T00:39:22Z","input":"xxh64:d2e9124a32b0a34f"},"govulndb":{"captured":"2026-10-13T00:38:57Z","input":"xxh64:22f1919a589c6961"},"hummingbird":{"captured":"2026-10-13T00:40:10Z","input":"xxh64:aca818e183e3c1b0"},"kev":{"captured":"2026-10-13T00:39:17Z","input":"xxh64:b0d499c7f5ff1cee"},"mariner":{"captured":"2026-10-13T00:38:56Z","input":"xxh64:8e45e13885901728"},"minimos":{"captured":"2026-10-13T00:38:55Z","input":"xxh64:f56940808a75a33c"},"nvd":{"captured":"2026-10-13T00:39:46Z","input":"xxh64:a388f055b49db819"},"oracle":{"captured":"2026-10-13T00:39:05Z","input":"xxh64:9dbe6f51c09db94c"},"photon":{"captured":"2026-10-13T00:39:03Z","input":"xxh64:0022a5e013a8e314"},"rhel":{"captured":"2026-10-13T00:39:18Z","input":"xxh64:6f12e0aff17a6489"},"secureos":{"captured":"2026-10-13T00:38:54Z","input":"xxh64:58dd3cfa3af8ab8f"},"sles":{"captured":"2026-10-12T00:41:00Z","input":"xxh64:4a5a88f30af2896c"},"ubuntu":{"captured":"2026-10-13T00:39:00Z","input":"xxh64:0b36e59d360c17fe"},"wolfi":{"captured":"2026-10-13T00:39:03Z","input":"xxh64:534f4c9c3d08c6f8"}}},"timestamp":"2026-10-15T10:16:50.731624+09:00"}}