lodash
npm
SEMVER · introduced 0 → fixed 4.17.21
GHSA-35jh-r3h4-6jhmPublished
Command Injection in lodash
Exact source revision recorded 24 Oct 2026 13:17:17 UTC. It does not establish the source's current position. Latest evidence.
osv · GHSA-35jh-r3h4-6jhm
Publishedlodash-es
npm
SEMVER · introduced 0 → fixed 4.17.21
lodash.template
npm
SEMVER · introduced 0 → last_affected 4.5.0
lodash-template
npm
SEMVER · introduced 0 → last_affected 1.0.0
lodash-rails
RubyGems
ECOSYSTEM · introduced 0 → fixed 4.17.21
55 explicitly affected versions
0.10.0, 0.7.0, 0.8.1, 0.8.2, 0.9.0, 0.9.1, 0.9.2, 1.0.0.rc.1, 1.0.0.rc.2, 1.0.0.rc.3, 1.0.1, 1.1.0, 1.1.1, 1.2.0, 1.2.1, 1.3.1, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.4.1, 3.1.0, 3.10.0, 3.10.1, 3.2.0, 3.3.0, 3.3.1, 3.3.1.1, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.9.3, 4.0.0, 4.11.2, 4.12.0, 4.13.1, 4.14.1, 4.15.0, 4.16.1, 4.16.3, 4.16.4, 4.16.6, 4.17.10, 4.17.11, 4.17.14, 4.17.15, 4.17.2, 4.17.4, 4.17.5, 4.3.0, 4.5.1, 4.6.1
Original source record · Cite this exact observation · Complete original publisher JSON