Security vulnerabilities and automated fixes for lodash issues
3 posts found
A high-severity prototype pollution vulnerability (CVE-2020-8203) was identified in the lodash library via the `zipObjectDeep` function, present as a transitive dependency through postcss in the project's `yarn.lock`. The fix upgrades postcss from 8.5.8 to 8.5.12 using a Yarn resolution override, eliminating the vulnerable lodash code path and reducing the attack surface against crafted CSS input. This change protects the application from object prototype manipulation that could lead to informat
CVE-2026-4800 is a high-severity arbitrary code execution vulnerability in lodash-es versions prior to 4.18.0, triggered through untrusted input passed to lodash's template engine. The fix upgrades lodash-es from 4.17.23 to 4.18.1 using a pnpm override, ensuring all transitive dependents pick up the patched version. This is a concrete reminder that even utility libraries like lodash can become critical attack surfaces when they process user-controlled input.
A high-severity arbitrary code execution vulnerability (CVE-2026-4800) was discovered in lodash's template function, specifically in how it handles the `imports` option with untrusted input. The fix upgrades lodash from version 4.17.21 to 4.18.0 in the project's `package.json` and `yarn.lock`, eliminating the attack surface where crafted template imports could execute arbitrary code on the server.