PkgSeer

Vulnerability GHSA-35jh-r3h4-6jhm

High Risk
HIGH RISK
CVSS Score: 7.2
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
5 years ago
May 06, 2021 at 04:05 PM UTC
Command Injection in lodash
0.1.0 - 4.17.20
0.1.0 - 4.17.20

Summary

Command Injection in lodash

Details

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk
6 months ago
lodash vulnerable to Code Injection via `_.template` imports key names
4.0.0 - 4.5.0 GHSA-r5fr-rjxr-66jc
4.0.0 - 4.5.0 GHSA-r5fr-rjxr-66jc
High Risk
6 months ago
lodash vulnerable to Code Injection via `_.template` imports key names
4.0.0 - 4.5.0 GHSA-r5fr-rjxr-66jc
4.0.0 - 4.5.0 GHSA-r5fr-rjxr-66jc
High Risk
6 months ago
lodash vulnerable to Code Injection via `_.template` imports key names
4.0.0 - 4.5.0 GHSA-r5fr-rjxr-66jc
4.0.0 - 4.5.0 GHSA-r5fr-rjxr-66jc
Medium Risk
6 months ago
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
3.0.0 - 4.17.23 GHSA-f23m-r3pf-42rh
3.0.0 - 4.17.23 GHSA-f23m-r3pf-42rh
Medium Risk
6 months ago
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
3.0.0 - 4.17.23 GHSA-f23m-r3pf-42rh
3.0.0 - 4.17.23 GHSA-f23m-r3pf-42rh
View all vulnerabilities for these packages

Impacted packages

Timeline

Published
5 years ago
May 06, 2021 at 04:05 PM UTC
Fixed (4.17.21)
5 years ago
February 20, 2021 at 03:42 PM UTC
Fixed (4.17.21)
5 years ago
February 20, 2021 at 03:43 PM UTC
Fixed (4.17.21)
5 years ago
May 11, 2021 at 08:24 AM UTC
Last Modified
16 hours ago
October 17, 2026 at 02:55 AM UTC