LO
Product
lodash
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 2Medium 6Low 0
Watch
Add lodash to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-4800 | 9.8 | Mar 31 | lodash vulnerable to Code Injection via `_.template` imports key names Affected: 4.0.0 before 4.18.1 |
| CVE-2019-10744 | 9.1 | Jul 26 | Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution Affected: before 4.17.12 |
| CVE-2020-8203 | 7.4 | Jul 15 | Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20 Affected: before 4.17.20 |
| CVE-2021-23337 | 7.2 | Feb 15 | Command Injection Affected: before 4.17.21 |
| CVE-2019-1010266 | 6.5 | Jul 17 | lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption Affected: before 4.17.11 |
| CVE-2018-3721 | 6.5 | Jun 7 | lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a… Affected: before 4.17.5 |
| CVE-2018-16487 | 5.6 | Feb 1 | A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of… Affected: before 4.17.11 |
| CVE-2026-2950 | 5.3 | Mar 31 | lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Affected: 4.17.23 before 4.18.1 |
| CVE-2025-13465 | 5.3 | Jan 21 | Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions Affected: 4.0.0 before 4.17.23 |
| CVE-2020-28500 | 5.3 | Feb 15 | Regular Expression Denial of Service (ReDoS) Affected: before 4.17.21 |
Showing 10