Is lodash safe ? 10 known vulnerabilities, worst severity CRITICAL.
// reach 0 direct dependencies
none carry a known advisory
2,902 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 92nd percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-jf85-cpcp-j695, the advisory selected below
// 10 advisories GHSA-jf85-cpcp-j695 Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects. CRIT GHSA-r5fr-rjxr-66jc The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. HIGH GHSA-35jh-r3h4-6jhm lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. HIGH GHSA-p6mc-m468-83gw Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays. HIGH GHSA-4xc9-xhrj-v574 Versions of lodash before 4.17.11 are vulnerable to prototype pollution. HIGH GHSA-f23m-r3pf-42rh The _.unset, _.omit, and _.pullAt functions are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. MODE GHSA-xxjr-mmjv-4gpg The _.unset, _.omit, and _.pullAt functions are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. MODE GHSA-29mw-wpgm-hmr9 All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. MODE GHSA-x5rq-j2xg-h7qm lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.7.11. MODE GHSA-fvqr-27wr-82fm Versions of lodash before 4.17.5 are vulnerable to prototype pollution. MODE Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
// recommendation Update to version 4.17.12 or later.
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability High Checked 2026-11-06 at 20:27 UTC. The most recent advisory here was published 2026-04-01. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page