VulnerableCode Package Details - pkg:deb/debian/node-lodash@4.17.23%2Bdfsg-1

Search for packages

Vulnerability	Summary	Fixed by
VCID-an5j-y3cq-gbfx Aliases: CVE-2026-4800 GHSA-r5fr-rjxr-66jc	lodash vulnerable to Code Injection via `_.template` imports key names ### Impact The fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink. When an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`. ### Patches Users should upgrade to version 4.18.0. The fix applies two changes: 1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option) 2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated ### Workarounds Do not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.	4.18.1+dfsg-1 Affected by 0 other vulnerabilities. 4.18.1+dfsg-2 Affected by 0 other vulnerabilities.
VCID-hjed-8rnm-kkbk Aliases: CVE-2026-2950 GHSA-f23m-r3pf-42rh	lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` ### Impact Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. ### Patches This issue is patched in 4.18.0. ### Workarounds None. Upgrade to the patched version.	4.18.1+dfsg-1 Affected by 0 other vulnerabilities. 4.18.1+dfsg-2 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-an5j-y3cq-gbfx
Aliases:
CVE-2026-4800
GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names ### Impact The fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink. When an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`. ### Patches Users should upgrade to version 4.18.0. The fix applies two changes: 1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option) 2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated ### Workarounds Do not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.

4.18.1+dfsg-1
Affected by 0 other vulnerabilities.

4.18.1+dfsg-2
Affected by 0 other vulnerabilities.

VCID-hjed-8rnm-kkbk
Aliases:
CVE-2026-2950
GHSA-f23m-r3pf-42rh

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` ### Impact Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as `Object.prototype`, `Number.prototype`, and `String.prototype`. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. ### Patches This issue is patched in 4.18.0. ### Workarounds None. Upgrade to the patched version.

4.18.1+dfsg-1
Affected by 0 other vulnerabilities.

4.18.1+dfsg-2
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-07T06:20:27.835602+00:00	Debian Importer	Affected by	VCID-hjed-8rnm-kkbk	https://security-tracker.debian.org/tracker/data/json	38.1.0
2026-04-04T18:07:09.272408+00:00	Debian Importer	Fixing	VCID-jsc5-qvjm-6kek	https://security-tracker.debian.org/tracker/data/json	38.1.0
2026-04-04T18:06:49.748521+00:00	Debian Importer	Affected by	VCID-an5j-y3cq-gbfx	https://security-tracker.debian.org/tracker/data/json	38.1.0