Packages / lodash / Security

HighVulnerabilityGHSA-35jh-r3h4-6jhmCVE-2021-23337Published 6 May 2021

Command Injection in lodash

Your version

Affected releases · lodash

  • 4.x4.0.0 – 4.17.20Fixed in 4.17.21
  • 3.x and older0.1.0 – 3.10.1No fix, no longer updated

On 4.x, the newest line:

npm install lodash@4.17.21
Every release on a timeline
4.x

  1. Affected

    4.0.0 – 4.17.20

    52 releases

  2. Fixed

    4.17.21 – 4.18.1

    4 releases, latest

3.x

  1. Affected

    3.0.0 – 3.10.1

    17 releases

2.x

  1. Affected

    2.0.0 – 2.4.2

    8 releases

1.x

  1. Affected

    1.0.0 – 1.3.1

    9 releases

0.x

  1. Affected

    0.1.0 – 0.10.0

    23 releases

113 stable releases of lodash, oldest to newest, one row per major.

What happens

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.