Package Instance

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

Command Injection in lodash
lodash versions prior to 4.17.21 are vulnerable to
Command Injection via the template function.

Regular Expression Denial of Service (ReDoS) in lodash
All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions.

Steps to reproduce (provided by reporter Liyuan Chen):
```js
var lo = require('lodash');

function build_blank(n) {
var ret = "1"
for (var i = 0; i < n; i++) {
ret += " "
}
return ret + "1";
}
var s = build_blank(50000) var time0 = Date.now();
lo.trim(s)
var time_cost0 = Date.now() - time0;
console.log("time_cost0: " + time_cost0);
var time1 = Date.now();
lo.toNumber(s) var time_cost1 = Date.now() - time1;
console.log("time_cost1: " + time_cost1);
var time2 = Date.now();
lo.trimEnd(s);
var time_cost2 = Date.now() - time2;
console.log("time_cost2: " + time_cost2);
```

Prototype Pollution in lodash
Versions of lodash prior to 4.17.19 are vulnerable to Prototype
Pollution. The functions `pick`, `set`, `setWith`, `update`,
`updateWith`, and `zipObjectDeep` allow a malicious user to
modify the prototype of Object if the property identifiers are
user-supplied. Being affected by this issue requires manipulating
objects based on user-provided property values or arrays.

This vulnerability causes the addition or modification of an
existing property that will exist on all objects and may lead to
Denial of Service or Code Execution under specific circumstances.

Denial of Service
Prototype pollution attack (lodash / constructor.prototype)