4 results · Clear filters · Feed
-
High 8.1CVE-2026-4800 Public exploit
lodash vulnerable to Code Injection via `_.template` imports key names
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …
-
High 7.2
Command Injection
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
-
High 7.4CVE-2020-8203 Public exploit
Prototype Pollution in lodash
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
-
High —
Prototype Pollution in lodash
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.