Command Injection in lodash

Description

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Recommendation

Update the lodash package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.17.21
• Patched version(s): 4.17.21

References

• GHSA-35jh-r3h4-6jhm
• snyk.io
• www.oracle.com
• cert-portal.siemens.com
• security.netapp.com
• CVE-2021-23337
• CWE-77
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDoS) in lodash - CVE-2020-28500
• Denial of Service in jquery - CVE-2016-10707
• Prototype Pollution in lodash (GHSA-p6mc-m468-83gw) - CVE-2020-8203
• Prototype Pollution in lodash (GHSA-jf85-cpcp-j695) - CVE-2019-10744

Tags:

npm

lodash