Command Injection in lodash

Description

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Recommendation

Update the lodash package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.17.21
• Patched version(s): 4.17.21

References

• GHSA-35jh-r3h4-6jhm
• snyk.io
• www.oracle.com
• cert-portal.siemens.com
• security.netapp.com
• CVE-2021-23337
• CWE-77
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Command Injection in lodash - lodash-es - CVE-2021-23337
• react-dev-utils OS Command Injection in function `getProcessForPort` - CVE-2021-24033
• Command Injection in @theia/messages - CVE-2021-28162
• Command injection in google-it - CVE-2021-34083

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

lodash