8 known vulnerabilities, worst severity CRITICAL.
how bad it is if exploited, 0 to 10
probability of exploitation in the next 30 days
CyberXYZ composite, 0 to 10
fig. 01 — worst case across every advisory for this package. Worst case, not average: one critical among nine minor issues is still a critical problem.
fig. 01, known advisories affecting lodash
Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
CWE-20 · Affected < 4.17.12 · fixed in 4.17.12
GHSANVDMITREreferencereferencereferencereferencereferencereferencereferencereferencereference
The fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.
CWE-77 · Affected >=0, <4.17.21 · fixed in 4.18.0
The fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.
CWE-94 · Affected >=4.0.0, <4.18.0 · fixed in 4.17.21
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.
CWE-770 · Affected >= 3.7.0, < 4.17.19 · fixed in 4.17.19
GHSANVDMITREreferencereferencereferencereferencereferencereferencereferencereferencereference
Versions of lodash before 4.17.11 are vulnerable to prototype pollution.
CWE-400 · Affected < 4.17.11 · fixed in 4.17.11
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Obje
CWE-1321 · Affected >=4.0.0, <4.17.23 · fixed in 4.18.0
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the .unset and .omit functions. The fix for [CVE-2025-13465](https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Obje
CWE-1321 · Affected >=4.0.0, <4.18.0 · fixed in 4.17.23
Versions of lodash before 4.17.5 are vulnerable to prototype pollution.
Affected < 4.17.5 · fixed in 4.17.5
Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
checked 2026-09-21 23:25 UTC · most recent advisory 2026-04-01 · updated continuously from NVD, GHSA, OSV and CNA feeds