{ "results": [ { "source": { "path": "~/projects/sca-benchmark-wt/refresh-latest/fixtures/npm-vuln-pinned/package-lock.json", "type": "lockfile" }, "packages": [ { "package": { "name": "lodash", "version": "4.17.15", "ecosystem": "npm", "purl": "pkg:npm/lodash@4.17.15?source=PUBLIC_REGISTRY" }, "groups": [ { "ids": [ "GHSA-29mw-wpgm-hmr9" ], "aliases": [ "CVE-2020-28500", "GHSA-29mw-wpgm-hmr9" ], "max_severity": "5.3" }, { "ids": [ "GHSA-35jh-r3h4-6jhm", "GHSA-r5fr-rjxr-66jc" ], "aliases": [ "CVE-2021-23337", "CVE-2026-4800", "GHSA-35jh-r3h4-6jhm", "GHSA-r5fr-rjxr-66jc" ], "max_severity": "8.1" }, { "ids": [ "GHSA-f23m-r3pf-42rh", "GHSA-xxjr-mmjv-4gpg" ], "aliases": [ "CVE-2025-13465", "CVE-2026-2950", "GHSA-f23m-r3pf-42rh", "GHSA-xxjr-mmjv-4gpg" ], "max_severity": "6.9" }, { "ids": [ "GHSA-p6mc-m468-83gw" ], "aliases": [ "CVE-2020-8203", "GHSA-p6mc-m468-83gw" ], "max_severity": "7.4" } ], "vulnerabilities": [ { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-29mw-wpgm-hmr9/GHSA-29mw-wpgm-hmr9.json" }, "package": { "ecosystem": "npm", "name": "lodash", "purl": "pkg:npm/lodash" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.17.21" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-29mw-wpgm-hmr9/GHSA-29mw-wpgm-hmr9.json" }, "package": { "ecosystem": "npm", "name": "lodash-es", "purl": "pkg:npm/lodash-es" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.17.21" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-29mw-wpgm-hmr9/GHSA-29mw-wpgm-hmr9.json" }, "package": { "ecosystem": "npm", "name": "lodash.trimend", "purl": "pkg:npm/lodash.trimend" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "last_affected": "4.5.1" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-29mw-wpgm-hmr9/GHSA-29mw-wpgm-hmr9.json" }, "package": { "ecosystem": "npm", "name": "lodash.trim", "purl": "pkg:npm/lodash.trim" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "last_affected": "4.5.1" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-29mw-wpgm-hmr9/GHSA-29mw-wpgm-hmr9.json" }, "package": { "ecosystem": "RubyGems", "name": "lodash-rails", "purl": "pkg:gem/lodash-rails" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.17.21" } ], "type": "ECOSYSTEM" } ], "versions": [ "4.0.0", "4.11.2", "4.12.0", "4.13.1", "4.14.1", "4.15.0", "4.16.1", "4.16.3", "4.16.4", "4.16.6", "4.17.10", "4.17.11", "4.17.14", "4.17.15", "4.17.2", "4.17.4", "4.17.5", "4.3.0", "4.5.1", "4.6.1" ] } ], "aliases": [ "CVE-2020-28500" ], "database_specific": { "cwe_ids": [ "CWE-1333", "CWE-400" ], "github_reviewed": true, "github_reviewed_at": "2021-03-19T22:45:28Z", "nvd_published_at": "2021-02-15T11:15:00Z", "severity": "MODERATE" }, "details": "All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions. \n\nSteps to reproduce (provided by reporter Liyuan Chen):\n```js\nvar lo = require('lodash');\n\nfunction build_blank(n) {\n var ret = \"1\"\n for (var i = 0; i \u003c n; i++) {\n ret += \" \"\n }\n return ret + \"1\";\n}\nvar s = build_blank(50000) var time0 = Date.now();\nlo.trim(s) \nvar time_cost0 = Date.now() - time0;\nconsole.log(\"time_cost0: \" + time_cost0);\nvar time1 = Date.now();\nlo.toNumber(s) var time_cost1 = Date.now() - time1;\nconsole.log(\"time_cost1: \" + time_cost1);\nvar time2 = Date.now();\nlo.trimEnd(s);\nvar time_cost2 = Date.now() - time2;\nconsole.log(\"time_cost2: \" + time_cost2);\n```", "id": "GHSA-29mw-wpgm-hmr9", "modified": "2025-09-29T21:12:31.102523Z", "published": "2022-01-06T20:30:46Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500" }, { "type": "WEB", "url": "https://github.com/github/advisory-database/pull/6139" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/pull/5065" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JS-LODASH-1018905" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20210312-0006" }, { "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-28500.yml" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8" }, { "type": "PACKAGE", "url": "https://github.com/lodash/lodash" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "type": "CVSS_V3" } ], "summary": "Regular Expression Denial of Service (ReDoS) in lodash" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-35jh-r3h4-6jhm/GHSA-35jh-r3h4-6jhm.json" }, "package": { "ecosystem": "npm", "name": "lodash", "purl": "pkg:npm/lodash" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "4.17.21" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-35jh-r3h4-6jhm/GHSA-35jh-r3h4-6jhm.json" }, "package": { "ecosystem": "npm", "name": "lodash-es", "purl": "pkg:npm/lodash-es" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "4.17.21" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-35jh-r3h4-6jhm/GHSA-35jh-r3h4-6jhm.json" }, "package": { "ecosystem": "npm", "name": "lodash.template", "purl": "pkg:npm/lodash.template" }, "ranges": [ { "events": [ { "introduced": "0" }, { "last_affected": "4.5.0" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-35jh-r3h4-6jhm/GHSA-35jh-r3h4-6jhm.json" }, "package": { "ecosystem": "npm", "name": "lodash-template", "purl": "pkg:npm/lodash-template" }, "ranges": [ { "events": [ { "introduced": "0" }, { "last_affected": "1.0.0" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/05/GHSA-35jh-r3h4-6jhm/GHSA-35jh-r3h4-6jhm.json" }, "package": { "ecosystem": "RubyGems", "name": "lodash-rails", "purl": "pkg:gem/lodash-rails" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "4.17.21" } ], "type": "ECOSYSTEM" } ], "versions": [ "0.10.0", "0.7.0", "0.8.1", "0.8.2", "0.9.0", "0.9.1", "0.9.2", "1.0.0.rc.1", "1.0.0.rc.2", "1.0.0.rc.3", "1.0.1", "1.1.0", "1.1.1", "1.2.0", "1.2.1", "1.3.1", "2.0.0", "2.1.0", "2.2.0", "2.2.1", "2.3.0", "2.4.0", "2.4.1", "3.1.0", "3.10.0", "3.10.1", "3.2.0", "3.3.0", "3.3.1", "3.3.1.1", "3.4.0", "3.5.0", "3.6.0", "3.7.0", "3.9.3", "4.0.0", "4.11.2", "4.12.0", "4.13.1", "4.14.1", "4.15.0", "4.16.1", "4.16.3", "4.16.4", "4.16.6", "4.17.10", "4.17.11", "4.17.14", "4.17.15", "4.17.2", "4.17.4", "4.17.5", "4.3.0", "4.5.1", "4.6.1" ] } ], "aliases": [ "CVE-2021-23337", "CVE-2026-4800", "GHSA-r5fr-rjxr-66jc" ], "database_specific": { "cwe_ids": [ "CWE-77", "CWE-94" ], "github_reviewed": true, "github_reviewed_at": "2021-03-31T23:59:26Z", "nvd_published_at": "2021-02-15T13:15:00Z", "severity": "HIGH" }, "details": "`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.", "id": "GHSA-35jh-r3h4-6jhm", "modified": "2026-09-10T03:49:04.067984836Z", "published": "2021-05-06T16:05:51Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23337" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JS-LODASH-1040724" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930" }, { "type": "WEB", "url": "https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20210312-0006" }, { "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851" }, { "type": "PACKAGE", "url": "https://github.com/lodash/lodash" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "Command Injection in lodash" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 4.17.23", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json" }, "package": { "ecosystem": "npm", "name": "lodash", "purl": "pkg:npm/lodash" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "4.18.0" } ], "type": "SEMVER" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.17.23", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json" }, "package": { "ecosystem": "npm", "name": "lodash-es", "purl": "pkg:npm/lodash-es" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "4.18.0" } ], "type": "SEMVER" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.17.23", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json" }, "package": { "ecosystem": "npm", "name": "lodash-amd", "purl": "pkg:npm/lodash-amd" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "4.18.0" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-f23m-r3pf-42rh/GHSA-f23m-r3pf-42rh.json" }, "package": { "ecosystem": "npm", "name": "lodash.unset", "purl": "pkg:npm/lodash.unset" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.18.0" } ], "type": "SEMVER" } ] } ], "aliases": [ "CVE-2025-13465", "CVE-2026-2950", "GHSA-xxjr-mmjv-4gpg" ], "database_specific": { "cwe_ids": [ "CWE-1321" ], "github_reviewed": true, "github_reviewed_at": "2026-04-01T23:50:27Z", "nvd_published_at": "2026-03-31T20:16:26Z", "severity": "MODERATE" }, "details": "### Impact\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`.\n\nThe issue permits deletion of prototype properties but does not allow overwriting their original behavior.\n\n### Patches\n\nThis issue is patched in 4.18.0.\n\n### Workarounds\n\nNone. Upgrade to the patched version.", "id": "GHSA-f23m-r3pf-42rh", "modified": "2026-09-10T03:50:44.050013812Z", "published": "2026-04-01T23:50:27Z", "references": [ { "type": "WEB", "url": "https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2950" }, { "type": "PACKAGE", "url": "https://github.com/lodash/lodash" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "type": "CVSS_V3" } ], "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`" }, { "affected": [ { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-p6mc-m468-83gw/GHSA-p6mc-m468-83gw.json" }, "package": { "ecosystem": "npm", "name": "lodash", "purl": "pkg:npm/lodash" }, "ranges": [ { "events": [ { "introduced": "3.7.0" }, { "fixed": "4.17.19" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-p6mc-m468-83gw/GHSA-p6mc-m468-83gw.json" }, "package": { "ecosystem": "npm", "name": "lodash-es", "purl": "pkg:npm/lodash-es" }, "ranges": [ { "events": [ { "introduced": "3.7.0" }, { "fixed": "4.17.20" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-p6mc-m468-83gw/GHSA-p6mc-m468-83gw.json" }, "package": { "ecosystem": "npm", "name": "lodash.pick", "purl": "pkg:npm/lodash.pick" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "last_affected": "4.4.0" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-p6mc-m468-83gw/GHSA-p6mc-m468-83gw.json" }, "package": { "ecosystem": "npm", "name": "lodash.set", "purl": "pkg:npm/lodash.set" }, "ranges": [ { "events": [ { "introduced": "3.7.0" }, { "last_affected": "4.3.2" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-p6mc-m468-83gw/GHSA-p6mc-m468-83gw.json" }, "package": { "ecosystem": "npm", "name": "lodash.setwith", "purl": "pkg:npm/lodash.setwith" }, "ranges": [ { "events": [ { "introduced": "0" }, { "last_affected": "4.3.2" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-p6mc-m468-83gw/GHSA-p6mc-m468-83gw.json" }, "package": { "ecosystem": "npm", "name": "lodash.update", "purl": "pkg:npm/lodash.update" }, "ranges": [ { "events": [ { "introduced": "0" }, { "last_affected": "4.10.2" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-p6mc-m468-83gw/GHSA-p6mc-m468-83gw.json" }, "package": { "ecosystem": "npm", "name": "lodash.updatewith", "purl": "pkg:npm/lodash.updatewith" }, "ranges": [ { "events": [ { "introduced": "0" }, { "last_affected": "4.10.2" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/07/GHSA-p6mc-m468-83gw/GHSA-p6mc-m468-83gw.json" }, "package": { "ecosystem": "RubyGems", "name": "lodash-rails", "purl": "pkg:gem/lodash-rails" }, "ranges": [ { "events": [ { "introduced": "3.7.0" }, { "fixed": "4.17.19" } ], "type": "ECOSYSTEM" } ], "versions": [ "3.10.0", "3.10.1", "3.7.0", "3.9.3", "4.0.0", "4.11.2", "4.12.0", "4.13.1", "4.14.1", "4.15.0", "4.16.1", "4.16.3", "4.16.4", "4.16.6", "4.17.10", "4.17.11", "4.17.14", "4.17.15", "4.17.2", "4.17.4", "4.17.5", "4.3.0", "4.5.1", "4.6.1" ] } ], "aliases": [ "CVE-2020-8203" ], "database_specific": { "cwe_ids": [ "CWE-1321", "CWE-770" ], "github_reviewed": true, "github_reviewed_at": "2020-07-15T19:14:58Z", "nvd_published_at": "2020-07-15T17:15:00Z", "severity": "HIGH" }, "details": "Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions `pick`, `set`, `setWith`, `update`, `updateWith`, and `zipObjectDeep` allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.\n\nThis vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.", "id": "GHSA-p6mc-m468-83gw", "modified": "2025-08-12T21:56:17.174859Z", "published": "2020-07-15T19:15:48Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8203" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/issues/4744" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/issues/4874" }, { "type": "WEB", "url": "https://github.com/github/advisory-database/pull/2884" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12" }, { "type": "WEB", "url": "https://hackerone.com/reports/712065" }, { "type": "WEB", "url": "https://hackerone.com/reports/864701" }, { "type": "PACKAGE", "url": "https://github.com/lodash/lodash" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/wiki/Changelog#v41719" }, { "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20200724-0006" }, { "type": "WEB", "url": "https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "type": "CVSS_V3" } ], "summary": "Prototype Pollution in lodash" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 4.17.23", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-r5fr-rjxr-66jc/GHSA-r5fr-rjxr-66jc.json" }, "package": { "ecosystem": "npm", "name": "lodash", "purl": "pkg:npm/lodash" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.18.0" } ], "type": "SEMVER" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.17.23", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-r5fr-rjxr-66jc/GHSA-r5fr-rjxr-66jc.json" }, "package": { "ecosystem": "npm", "name": "lodash-es", "purl": "pkg:npm/lodash-es" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.18.0" } ], "type": "SEMVER" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.17.23", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-r5fr-rjxr-66jc/GHSA-r5fr-rjxr-66jc.json" }, "package": { "ecosystem": "npm", "name": "lodash-amd", "purl": "pkg:npm/lodash-amd" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.18.0" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-r5fr-rjxr-66jc/GHSA-r5fr-rjxr-66jc.json" }, "package": { "ecosystem": "npm", "name": "lodash.template", "purl": "pkg:npm/lodash.template" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.18.0" } ], "type": "SEMVER" } ] } ], "aliases": [ "CVE-2021-23337", "CVE-2026-4800", "GHSA-35jh-r3h4-6jhm" ], "database_specific": { "cwe_ids": [ "CWE-94" ], "github_reviewed": true, "github_reviewed_at": "2026-04-01T23:51:12Z", "nvd_published_at": "2026-03-31T20:16:29Z", "severity": "HIGH" }, "details": "### Impact\n\nThe fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink.\n\nWhen an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`.\n\n### Patches\n\nUsers should upgrade to version 4.18.0.\n\nThe fix applies two changes:\n1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option)\n2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated\n\n### Workarounds\n\nDo not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.", "id": "GHSA-r5fr-rjxr-66jc", "modified": "2026-09-10T03:51:02.970455926Z", "published": "2026-04-01T23:51:12Z", "references": [ { "type": "WEB", "url": "https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4800" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c" }, { "type": "WEB", "url": "https://cna.openjsf.org/security-advisories.html" }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-35jh-r3h4-6jhm" }, { "type": "PACKAGE", "url": "https://github.com/lodash/lodash" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "lodash vulnerable to Code Injection via `_.template` imports key names" }, { "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 4.17.22", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json" }, "package": { "ecosystem": "npm", "name": "lodash", "purl": "pkg:npm/lodash" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.17.23" } ], "type": "SEMVER" } ] }, { "database_specific": { "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json" }, "package": { "ecosystem": "npm", "name": "lodash.unset", "purl": "pkg:npm/lodash.unset" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "last_affected": "4.5.2" } ], "type": "SEMVER" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.17.22", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json" }, "package": { "ecosystem": "npm", "name": "lodash-es", "purl": "pkg:npm/lodash-es" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.17.23" } ], "type": "SEMVER" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.17.22", "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-xxjr-mmjv-4gpg/GHSA-xxjr-mmjv-4gpg.json" }, "package": { "ecosystem": "npm", "name": "lodash-amd", "purl": "pkg:npm/lodash-amd" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "4.17.23" } ], "type": "SEMVER" } ] } ], "aliases": [ "CVE-2025-13465", "CVE-2026-2950", "GHSA-f23m-r3pf-42rh" ], "database_specific": { "cwe_ids": [ "CWE-1321" ], "github_reviewed": true, "github_reviewed_at": "2026-01-21T23:01:22Z", "nvd_published_at": "2026-01-21T20:16:05Z", "severity": "MODERATE" }, "details": "### Impact\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. \n\nThe issue permits deletion of properties but does not allow overwriting their original behavior. \n\n### Patches\n\nThis issue is patched on 4.17.23.", "id": "GHSA-xxjr-mmjv-4gpg", "modified": "2026-09-10T03:50:33.722177022Z", "published": "2026-01-21T23:01:22Z", "references": [ { "type": "WEB", "url": "https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg" }, { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13465" }, { "type": "WEB", "url": "https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/html/ssa-253495.html" }, { "type": "PACKAGE", "url": "https://github.com/lodash/lodash" } ], "schema_version": "1.9.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P", "type": "CVSS_V4" } ], "summary": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions" } ] } ] } ], "experimental_config": { "licenses": { "summary": false, "allowlist": null } } }