lodash/lodash

jquery 3.4.1

1 advisory, actively exploited. Fixed in 3.5.0.

How it can be abusedAn attacker could trick a browser into running malicious HTML or scripts if the vulnerable jQuery version is loaded on a page that inserts untrusted content into the DOM. Anyone using a web page that bundles this jQuery version would be affected.

• mediumGHSA-jpcq-cgw6-v4j6exploitedPotential XSS vulnerability in jQuery

babel-traverse 6.26.0

1 advisory. Fixed in 7.23.2.

How it can be abusedIf an attacker can trick a developer or CI job into running Babel over attacker-controlled JavaScript, the vulnerable version can run arbitrary code on that machine. Here the build only processes trusted Lodash source files, so mainly developers building projects that compile untrusted third-party code are exposed.

• criticalGHSA-67hx-6x53-jw92Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code

form-data 0.1.4

2 advisories. Fixed in 2.5.4.

How it can be abusedAn attacker could send crafted multipart form data that breaks out of a field name or filename to inject extra parts or headers, and the weak random boundary lets them guess the separator used to split uploads, potentially smuggling files or data past a server's checks. This only matters for apps using form-data to upload content, but this repo (lodash) does not use it at all.

• criticalGHSA-fjxv-7rqg-78g4form-data uses unsafe random function in form-data for choosing boundary
• highGHSA-hmw2-7cc7-3qxxform-data: CRLF injection in form-data via unescaped multipart field names and filenames

fsevents 1.2.2

1 advisory. Fixed in 1.2.11.

How it can be abusedAn attacker who can influence file names or paths being watched could get their own code executed on the machine running the build or tests. This only matters for developers using this library's tooling on macOS, since fsevents is a Mac-only file watcher and end users of lodash itself never run it.

• criticalGHSA-8r6j-v8pm-fqw3Code injection in fsevents

handlebars 4.1.2

13 advisories. Fixed in 3.0.8.

How it can be abusedAn attacker who can get a malicious or tampered template into a project using Handlebars could inject JavaScript that runs on the server when the template is compiled, or crash the app with crafted input. In this lodash repository Handlebars is not meaningfully used, so real exposure here is minimal.

• highGHSA-2cf5-4w76-r9qvArbitrary Code Execution in handlebars
• criticalGHSA-2w6w-674q-4c4qHandlebars.js has JavaScript Injection via AST Type Confusion
• highGHSA-3cqr-58rm-57f8Arbitrary Code Execution in Handlebars
• highGHSA-3mfm-83xf-c92rHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
• highGHSA-62gr-4qp9-h98fRegular Expression Denial of Service in Handlebars
• criticalGHSA-765h-qjxv-5f44Prototype Pollution in handlebars
• highGHSA-9cx6-37pm-9jffHandlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
• criticalGHSA-f2jv-r9rf-7988Remote code execution in handlebars when compiling templates
• highGHSA-g9r4-xpmj-mj65Prototype Pollution in handlebars
• highGHSA-q2c6-c6pm-g3ghArbitrary Code Execution in handlebars
• criticalGHSA-w457-6q6x-cgp9Prototype Pollution in handlebars
• highGHSA-xhpv-hc6g-r9c6Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
• highGHSA-xjpj-3mr7-gcpfHandlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options

json-schema 0.2.3

1 advisory. Fixed in 0.4.0.

How it can be abusedThe json-schema package lets an attacker add or overwrite properties on JavaScript's base Object through crafted input, which can corrupt how the whole application behaves or sneak in unexpected values during validation. Lodash itself does not depend on json-schema, so projects using only this repo are not affected unless something else in their toolchain pulls it in.

• criticalGHSA-896r-f27r-55mwjson-schema is vulnerable to Prototype Pollution

loader-utils 0.2.17

1 advisory. Fixed in 2.0.3.

How it can be abusedThis bug lives in a webpack build helper, not in lodash itself. If a project's build used loader-utils to parse query strings from untrusted input, an attacker could sneak keys like __proto__ into those strings and pollute every JavaScript object with new properties, potentially breaking or hijacking code at build time. Only developers running such builds are exposed; users of the published lodash library are not.

• criticalGHSA-76p3-8jx3-jpfqPrototype pollution in webpack loader-utils

minimist 1.2.0

1 advisory. Fixed in 1.2.6.

How it can be abusedAn attacker who can control command-line arguments passed to scripts using minimist could add special keys that inject properties onto JavaScript's base Object, potentially breaking or hijacking code that runs afterward. Here it would mainly affect developers running this repo's build and test pipeline locally, not end users of lodash itself.

• criticalGHSA-xvch-5gv4-984hPrototype Pollution in minimist

sha.js 2.2.6

1 advisory. Fixed in 2.4.12.

How it can be abusedAn attacker could feed specially crafted data to code using sha.js, causing the hash computation to rewind and accept data it should have rejected, which could break signature or integrity checks in apps that depend on it. This repo (lodash) does not actually use sha.js; lodash has no runtime dependencies, so its users are not affected.

• criticalGHSA-95m3-7q98-8xr5sha.js is missing type checks leading to hash rewind and passing on crafted data

tar 4.4.10

14 advisories. Fixed in 7.5.19.

How it can be abusedIf this project's install or build steps unpacked a tar archive from an untrusted source, an attacker could craft it so files get written outside the intended folder, overwriting code or planting malicious scripts, and anyone building the project would be affected. In this repository, though, tar is at most a build-time helper and never extracts attacker-supplied archives, so there is no realistic path for exploitation here.

• criticalGHSA-23hp-3jrh-7fpwnode-tar: Decompression/parse DoS via unlimited input
• highGHSA-34x7-hfp2-rc4vnode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
• highGHSA-3jfq-g458-7qm9Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization
• highGHSA-5955-9wpr-37jhArbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
• highGHSA-83g3-92jg-28cxArbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction
• highGHSA-8qq5-rm4j-mr97node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
• highGHSA-8x88-c5mf-7j5wnode-tar: Negative tar entry size causes infinite loop in archive replace
• highGHSA-9ppj-qmqm-q256node-tar Symlink Path Traversal via Drive-Relative Linkpath
• highGHSA-9r2w-394v-53qcArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
• highGHSA-qffp-2rhf-9h96tar has Hardlink Path Traversal via Drive-Relative Linkpath
• highGHSA-qq89-hq3f-393pArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
• highGHSA-r292-9mhp-454mnode-tar: Uncontrolled recursion in mapHas/filesFilter allows uncatchable stack-overflow DoS via crafted long-path tar with member selection
• highGHSA-r628-mhmh-qjhwArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
• highGHSA-r6q2-hw4h-h46wRace Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS

underscore 1.6.0

2 advisories. Fixed in 1.12.1.

How it can be abusedAn attacker could get their own code executed by sneaking template syntax into text that gets run through Underscore's template function, or crash an app by feeding it deeply nested data that makes its comparison and flattening helpers recurse forever. This affects any application that uses this old version to render user-provided content or process untrusted input, though this repository itself does not actually use Underscore as a dependency.

• criticalGHSA-cf4h-3jhx-xvhqArbitrary Code Execution in underscore
• highGHSA-qpx9-hpmf-5gmwUnderscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

async 2.6.3

1 advisory. Fixed in 3.2.2.

How it can be abusedAn attacker who can control input to certain async helper functions could sneak extra keys onto JavaScript's base object template, so every object in the program suddenly gains unexpected properties. This only matters for projects that actually run the async library; this lodash repo builds and tests its own single-file utility library and does not meaningfully depend on async at runtime.

• highGHSA-fwr7-v2mv-hh25Prototype Pollution in async

brace-expansion 1.1.11

3 advisories. Fixed in 5.0.7.

How it can be abusedAn attacker who can control a filename or pattern passed to this package's expansion code, for example through file-matching in a project's build or test scripts, could supply a crafted pattern that makes the process spin for a long time or consume all memory and crash. Only developers or CI systems running those tools would be affected; users of the shipped library would not, since this package is not part of the runtime bundle.

• highGHSA-3jxr-9vmj-r5cpbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups
• highGHSA-mh99-v99m-4gvgbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash
• highGHSA-rgw5-rvv9-x895brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

braces 1.8.5

1 advisory. Fixed in 3.0.3.

How it can be abusedAn attacker could send a specially crafted glob pattern, like a very long string of nested curly braces, that makes braces expand into billions of possibilities and freeze or crash the server. This only matters for applications that call braces on input from users; the lodash repo itself does not use this package in its library or build process.

• highGHSA-grv7-fg5c-xmjgUncontrolled resource consumption in braces

cross-spawn 5.1.0

1 advisory. Fixed in 7.0.5.

How it can be abusedThis package spawns other programs during builds and can hang forever if it is asked to run a command whose name contains certain special characters that trip its internal pattern matching. Only developers running this project's build scripts are exposed, and only if an attacker can control the command or arguments being run, so people using the published lodash library are not affected.

• highGHSA-3xgq-45jj-v275Regular Expression Denial of Service (ReDoS) in cross-spawn

css-what 2.1.0

1 advisory. Fixed in 2.1.3.

How it can be abusedAn attacker could send a crafted CSS selector string that makes the parser hang while processing it, freezing the server until it finishes. However, css-what is a CSS selector parser used by tools like cheerio, and this lodash repo does not use it at all, so no one building from this code is affected.

• highGHSA-p28h-cc7q-c4fgcss-what vulnerable to ReDoS due to use of insecure regular expression

dojo 1.15.0

2 advisories. Fixed in 1.11.10.

How it can be abusedAn attacker could trick code that merges untrusted user input into objects into adding properties to a base object template, letting them tamper with how the app behaves or sneak in malicious values. This affects any application using the vulnerable package where attacker-controlled data reaches those merge functions.

• highGHSA-jxfh-8wgv-vfr2Prototype pollution in dojo
• highGHSA-m8gw-hjpr-rjv7Prototype Pollution in dojo

hawk 1.1.1

2 advisories. Fixed in 9.0.1.

How it can be abusedHawk is a library that verifies signed HTTP requests, and these flaws let an attacker crash or freeze any server that uses it to check incoming request headers, just by sending specially crafted requests. However, this repository does not use hawk at all; it is a JavaScript utility library with no runtime dependencies, so nothing here is exposed.

• highGHSA-44pw-h2cw-w3vqUncontrolled Resource Consumption in Hawk
• highGHSA-jcpv-g9rr-qxrcRegular Expression Denial of Service in hawk

hoek 0.9.1

2 advisories. Fixed in 8.5.1.

How it can be abusedAn attacker who can control input passed to hoek's clone function can sneak extra keys onto JavaScript's base Object, which can then break security checks or cause crashes anywhere in the app that reads object properties. However, this only matters for projects that actually use the hoek package.

• highGHSA-c429-5p7v-vgjphoek subject to prototype pollution via the clone function.
• highGHSA-jp4x-w63m-7wgmPrototype Pollution in hoek

i 0.3.6

1 advisory. Fixed in 0.3.7.

How it can be abusedAn attacker could send crafted words or strings to the inflection functions, which use slow regular expressions that can hang the CPU and freeze the app for everyone. However, this package is not part of Lodash or its build pipeline, so nothing in this repo actually uses it.

• highGHSA-x55w-vjjp-222rinflect vulnerable to Inefficient Regular Expression Complexity

ini 1.3.5

1 advisory. Fixed in 1.3.6.

How it can be abusedAn attacker who can get the app to parse a malicious config or settings file could sneak extra keys into it that overwrite built-in JavaScript object properties, potentially breaking security checks or causing crashes. This only matters for code that parses untrusted ini files with this package, which is not part of lodash itself and would at most affect developer tooling during builds.

• highGHSA-qqgx-2p2h-9c37ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse

js-yaml 3.13.1

2 advisories. Fixed in 3.15.0.

How it can be abusedAn attacker who can feed crafted YAML files into a program using this package could send deeply chained merge keys or special ordered-map tags that make the parser burn huge amounts of CPU on one small file, freezing or slowing the service for everyone. This only matters where untrusted YAML is parsed; this lodash repository does not parse YAML from users, so its own code is not exposed.

• highGHSA-52cp-r559-cp3mjs-yaml: YAML merge-key chains can force quadratic CPU consumption
• highGHSA-5p4m-2wfm-xmqjJS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

json5 0.5.1

1 advisory. Fixed in 2.2.2.

How it can be abusedIf any build or test script parsed attacker-influenced JSON5 files with this old version, an attacker could sneak extra keys like __proto__ into parsed objects and pollute every JavaScript object in the process, potentially hijacking library behavior during builds. However, this repo does not actually depend on json5 anywhere in its runtime or build pipeline, so no real attack path exists here.

• highGHSA-9c47-m6qq-7p4hPrototype Pollution in JSON5 via Parse Method

lodash 4.17.20

2 advisories. Fixed in 4.17.21.

How it can be abusedIf an app passes user-controlled data as variable names into lodash's template function, an attacker can sneak JavaScript code into the generated template and run it on your server or in your users' browsers. Anyone running a server that builds templates from untrusted input is affected; this repo itself only uses templates internally during its own build, so it is not directly exposed.

• highGHSA-35jh-r3h4-6jhmCommand Injection in lodash
• highGHSA-r5fr-rjxr-66jclodash vulnerable to Code Injection via `_.template` imports key names

lodash.pick 4.4.0

1 advisory. Fixed in 4.17.19.

How it can be abusedIf an app calls pick on data that includes attacker-controlled keys or paths, such as JSON from a request, an attacker can use a key like __proto__ to add properties to JavaScript's base Object, which then shows up on every object in the running program and can break logic or enable further attacks. Any application or server using lodash.pick with untrusted input is affected.

• highGHSA-p6mc-m468-83gwPrototype Pollution in lodash

minimatch 3.0.4

4 advisories. Fixed in 10.2.3.

How it can be abusedAn attacker who can control a filename or path passed through the build or test tooling could craft a name that makes minimatch's pattern matching hang, freezing the developer's machine or CI job. Only people running the repo's build and test scripts are affected; the published lodash library itself does not include minimatch.

• highGHSA-23c5-xmqv-rm74minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions
• highGHSA-3ppc-4f35-3m26minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern
• highGHSA-7r86-cg39-jmmjminimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments
• highGHSA-f8q6-p94x-37v3minimatch ReDoS vulnerability

nth-check 1.0.1

1 advisory. Fixed in 2.0.1.

How it can be abusedThis flaw is in a package that parses CSS selectors, not in lodash. An attacker could only exploit it if this project parsed untrusted HTML with tools like cheerio that use nth-check, causing the app to hang or slow to a crawl; lodash itself does not depend on it, so users of this library are not affected.

• highGHSA-rp65-9cf3-cjxrInefficient Regular Expression Complexity in nth-check

pathval 0.1.1

1 advisory. Fixed in 1.1.1.

How it can be abusedAn attacker who can control a property path string could set values on Object.prototype, adding or overwriting properties that every JavaScript object inherits, which can break security checks or lead to code execution in apps using the library. However, pathval is a small test-assertion helper not part of lodash's runtime code, so this repo's shipped library and its users are not affected.

• highGHSA-g6ww-v8xp-vmwgPrototype pollution in pathval

qs 1.2.2

2 advisories. Fixed in 6.0.4.

How it can be abusedAn attacker could send crafted query strings with keys like __proto__ to any server that parses them with this old qs version, letting them inject properties into JavaScript's base object and potentially crash the app or alter its behavior. This only affects projects that actually use qs to parse request input, which this lodash repo does not, since it ships no runtime dependencies.

• highGHSA-gqgv-6jq5-jjj9Prototype Pollution Protection Bypass in qs
• highGHSA-hrpp-h998-j3ppqs vulnerable to Prototype Pollution

requirejs 2.3.6

1 advisory. Fixed in 2.3.7.

How it can be abusedAn attacker who can influence the paths or configuration passed to RequireJS could inject properties onto JavaScript's base Object prototype, causing unexpected behavior or code execution in any app that loads scripts through it. Here, RequireJS is only used inside the build pipeline with trusted local files, so the people exposed are developers running builds, not end users of the library.

• highGHSA-x3m3-4wpv-5vgcjrburke requirejs vulnerable to prototype pollution