Skip to content

Commit ae874c5

Browse files
eoftedalgithub-actions[bot]
eoftedal
and
github-actions[bot]
authored
Updated libraries (1): lodash Updated vulnerability IDs (4): GHSA-35jh-r3h4-6jhm, GHSA-f23m-r3pf-42rh, GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent ad89aff commit ae874c5

9 files changed

Lines changed: 54 additions & 18 deletions

‎repository/jsrepository-master.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11176,7 +11176,8 @@
1117611176
"severity": "high",
1117711177
"identifiers": {
1117811178
"CVE": [
11179-
"CVE-2021-23337"
11179+
"CVE-2021-23337",
11180+
"CVE-2026-4800"
1118011181
],
1118111182
"githubID": "GHSA-35jh-r3h4-6jhm"
1118211183
},
@@ -11254,7 +11255,8 @@
1125411255
"identifiers": {
1125511256
"githubID": "GHSA-xxjr-mmjv-4gpg",
1125611257
"CVE": [
11257-
"CVE-2025-13465"
11258+
"CVE-2025-13465",
11259+
"CVE-2026-2950"
1125811260
]
1125911261
},
1126011262
"severity": "medium",
@@ -11278,6 +11280,7 @@
1127811280
"identifiers": {
1127911281
"githubID": "GHSA-f23m-r3pf-42rh",
1128011282
"CVE": [
11283+
"CVE-2025-13465",
1128111284
"CVE-2026-2950"
1128211285
]
1128311286
},
@@ -11302,6 +11305,7 @@
1130211305
"identifiers": {
1130311306
"githubID": "GHSA-r5fr-rjxr-66jc",
1130411307
"CVE": [
11308+
"CVE-2021-23337",
1130511309
"CVE-2026-4800"
1130611310
]
1130711311
},

‎repository/jsrepository-v2.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12643,7 +12643,8 @@
1264312643
"identifiers": {
1264412644
"summary": "Command Injection in lodash",
1264512645
"CVE": [
12646-
"CVE-2021-23337"
12646+
"CVE-2021-23337",
12647+
"CVE-2026-4800"
1264712648
],
1264812649
"githubID": "GHSA-35jh-r3h4-6jhm"
1264912650
},
@@ -12716,7 +12717,8 @@
1271612717
"summary": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths to delete methods from global prototypes such as Object.prototype, though the issue only permits deletion and not overwriting of properties.",
1271712718
"githubID": "GHSA-xxjr-mmjv-4gpg",
1271812719
"CVE": [
12719-
"CVE-2025-13465"
12720+
"CVE-2025-13465",
12721+
"CVE-2026-2950"
1272012722
]
1272112723
},
1272212724
"info": [
@@ -12735,6 +12737,7 @@
1273512737
"summary": "Lodash 4.17.23 and earlier are vulnerable to a prototype pollution bypass in _.unset and _.omit. The fix for CVE-2025-13465 only guards against string key members, so attackers can bypass it by passing array-wrapped path segments to delete properties from built-in prototypes including Object.prototype, Number.prototype, and String.prototype.",
1273612738
"githubID": "GHSA-f23m-r3pf-42rh",
1273712739
"CVE": [
12740+
"CVE-2025-13465",
1273812741
"CVE-2026-2950"
1273912742
]
1274012743
},
@@ -12754,6 +12757,7 @@
1275412757
"summary": "Lodash _.template is vulnerable to code injection via unsanitized options.imports key names. Untrusted key names are passed to the Function() constructor sink without validation, and the use of assignInWith (which enumerates inherited properties) also means that pre-existing prototype pollution on Object.prototype can flow into the Function() sink and execute arbitrary code at template compilation time.",
1275512758
"githubID": "GHSA-r5fr-rjxr-66jc",
1275612759
"CVE": [
12760+
"CVE-2021-23337",
1275712761
"CVE-2026-4800"
1275812762
]
1275912763
},

‎repository/jsrepository-v3.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12829,7 +12829,8 @@
1282912829
"identifiers": {
1283012830
"summary": "Command Injection in lodash",
1283112831
"CVE": [
12832-
"CVE-2021-23337"
12832+
"CVE-2021-23337",
12833+
"CVE-2026-4800"
1283312834
],
1283412835
"githubID": "GHSA-35jh-r3h4-6jhm"
1283512836
},
@@ -12902,7 +12903,8 @@
1290212903
"summary": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths to delete methods from global prototypes such as Object.prototype, though the issue only permits deletion and not overwriting of properties.",
1290312904
"githubID": "GHSA-xxjr-mmjv-4gpg",
1290412905
"CVE": [
12905-
"CVE-2025-13465"
12906+
"CVE-2025-13465",
12907+
"CVE-2026-2950"
1290612908
]
1290712909
},
1290812910
"info": [
@@ -12921,6 +12923,7 @@
1292112923
"summary": "Lodash 4.17.23 and earlier are vulnerable to a prototype pollution bypass in _.unset and _.omit. The fix for CVE-2025-13465 only guards against string key members, so attackers can bypass it by passing array-wrapped path segments to delete properties from built-in prototypes including Object.prototype, Number.prototype, and String.prototype.",
1292212924
"githubID": "GHSA-f23m-r3pf-42rh",
1292312925
"CVE": [
12926+
"CVE-2025-13465",
1292412927
"CVE-2026-2950"
1292512928
]
1292612929
},
@@ -12940,6 +12943,7 @@
1294012943
"summary": "Lodash _.template is vulnerable to code injection via unsanitized options.imports key names. Untrusted key names are passed to the Function() constructor sink without validation, and the use of assignInWith (which enumerates inherited properties) also means that pre-existing prototype pollution on Object.prototype can flow into the Function() sink and execute arbitrary code at template compilation time.",
1294112944
"githubID": "GHSA-r5fr-rjxr-66jc",
1294212945
"CVE": [
12946+
"CVE-2021-23337",
1294312947
"CVE-2026-4800"
1294412948
]
1294512949
},

‎repository/jsrepository-v4.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12828,7 +12828,8 @@
1282812828
"identifiers": {
1282912829
"summary": "Command Injection in lodash",
1283012830
"CVE": [
12831-
"CVE-2021-23337"
12831+
"CVE-2021-23337",
12832+
"CVE-2026-4800"
1283212833
],
1283312834
"githubID": "GHSA-35jh-r3h4-6jhm"
1283412835
},
@@ -12901,7 +12902,8 @@
1290112902
"summary": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths to delete methods from global prototypes such as Object.prototype, though the issue only permits deletion and not overwriting of properties.",
1290212903
"githubID": "GHSA-xxjr-mmjv-4gpg",
1290312904
"CVE": [
12904-
"CVE-2025-13465"
12905+
"CVE-2025-13465",
12906+
"CVE-2026-2950"
1290512907
]
1290612908
},
1290712909
"info": [
@@ -12920,6 +12922,7 @@
1292012922
"summary": "Lodash 4.17.23 and earlier are vulnerable to a prototype pollution bypass in _.unset and _.omit. The fix for CVE-2025-13465 only guards against string key members, so attackers can bypass it by passing array-wrapped path segments to delete properties from built-in prototypes including Object.prototype, Number.prototype, and String.prototype.",
1292112923
"githubID": "GHSA-f23m-r3pf-42rh",
1292212924
"CVE": [
12925+
"CVE-2025-13465",
1292312926
"CVE-2026-2950"
1292412927
]
1292512928
},
@@ -12939,6 +12942,7 @@
1293912942
"summary": "Lodash _.template is vulnerable to code injection via unsanitized options.imports key names. Untrusted key names are passed to the Function() constructor sink without validation, and the use of assignInWith (which enumerates inherited properties) also means that pre-existing prototype pollution on Object.prototype can flow into the Function() sink and execute arbitrary code at template compilation time.",
1294012943
"githubID": "GHSA-r5fr-rjxr-66jc",
1294112944
"CVE": [
12945+
"CVE-2021-23337",
1294212946
"CVE-2026-4800"
1294312947
]
1294412948
},

‎repository/jsrepository-v5-combined.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12835,7 +12835,8 @@
1283512835
"identifiers": {
1283612836
"summary": "Command Injection in lodash",
1283712837
"CVE": [
12838-
"CVE-2021-23337"
12838+
"CVE-2021-23337",
12839+
"CVE-2026-4800"
1283912840
],
1284012841
"githubID": "GHSA-35jh-r3h4-6jhm"
1284112842
},
@@ -12908,7 +12909,8 @@
1290812909
"summary": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths to delete methods from global prototypes such as Object.prototype, though the issue only permits deletion and not overwriting of properties.",
1290912910
"githubID": "GHSA-xxjr-mmjv-4gpg",
1291012911
"CVE": [
12911-
"CVE-2025-13465"
12912+
"CVE-2025-13465",
12913+
"CVE-2026-2950"
1291212914
]
1291312915
},
1291412916
"info": [
@@ -12927,6 +12929,7 @@
1292712929
"summary": "Lodash 4.17.23 and earlier are vulnerable to a prototype pollution bypass in _.unset and _.omit. The fix for CVE-2025-13465 only guards against string key members, so attackers can bypass it by passing array-wrapped path segments to delete properties from built-in prototypes including Object.prototype, Number.prototype, and String.prototype.",
1292812930
"githubID": "GHSA-f23m-r3pf-42rh",
1292912931
"CVE": [
12932+
"CVE-2025-13465",
1293012933
"CVE-2026-2950"
1293112934
]
1293212935
},
@@ -12946,6 +12949,7 @@
1294612949
"summary": "Lodash _.template is vulnerable to code injection via unsanitized options.imports key names. Untrusted key names are passed to the Function() constructor sink without validation, and the use of assignInWith (which enumerates inherited properties) also means that pre-existing prototype pollution on Object.prototype can flow into the Function() sink and execute arbitrary code at template compilation time.",
1294712950
"githubID": "GHSA-r5fr-rjxr-66jc",
1294812951
"CVE": [
12952+
"CVE-2021-23337",
1294912953
"CVE-2026-4800"
1295012954
]
1295112955
},

‎repository/jsrepository-v5.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12834,7 +12834,8 @@
1283412834
"identifiers": {
1283512835
"summary": "Command Injection in lodash",
1283612836
"CVE": [
12837-
"CVE-2021-23337"
12837+
"CVE-2021-23337",
12838+
"CVE-2026-4800"
1283812839
],
1283912840
"githubID": "GHSA-35jh-r3h4-6jhm"
1284012841
},
@@ -12907,7 +12908,8 @@
1290712908
"summary": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths to delete methods from global prototypes such as Object.prototype, though the issue only permits deletion and not overwriting of properties.",
1290812909
"githubID": "GHSA-xxjr-mmjv-4gpg",
1290912910
"CVE": [
12910-
"CVE-2025-13465"
12911+
"CVE-2025-13465",
12912+
"CVE-2026-2950"
1291112913
]
1291212914
},
1291312915
"info": [
@@ -12926,6 +12928,7 @@
1292612928
"summary": "Lodash 4.17.23 and earlier are vulnerable to a prototype pollution bypass in _.unset and _.omit. The fix for CVE-2025-13465 only guards against string key members, so attackers can bypass it by passing array-wrapped path segments to delete properties from built-in prototypes including Object.prototype, Number.prototype, and String.prototype.",
1292712929
"githubID": "GHSA-f23m-r3pf-42rh",
1292812930
"CVE": [
12931+
"CVE-2025-13465",
1292912932
"CVE-2026-2950"
1293012933
]
1293112934
},
@@ -12945,6 +12948,7 @@
1294512948
"summary": "Lodash _.template is vulnerable to code injection via unsanitized options.imports key names. Untrusted key names are passed to the Function() constructor sink without validation, and the use of assignInWith (which enumerates inherited properties) also means that pre-existing prototype pollution on Object.prototype can flow into the Function() sink and execute arbitrary code at template compilation time.",
1294612949
"githubID": "GHSA-r5fr-rjxr-66jc",
1294712950
"CVE": [
12951+
"CVE-2021-23337",
1294812952
"CVE-2026-4800"
1294912953
]
1295012954
},

‎repository/jsrepository-v6-combined.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13065,7 +13065,8 @@
1306513065
"identifiers": {
1306613066
"summary": "Command Injection in lodash",
1306713067
"CVE": [
13068-
"CVE-2021-23337"
13068+
"CVE-2021-23337",
13069+
"CVE-2026-4800"
1306913070
],
1307013071
"githubID": "GHSA-35jh-r3h4-6jhm"
1307113072
},
@@ -13138,7 +13139,8 @@
1313813139
"summary": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths to delete methods from global prototypes such as Object.prototype, though the issue only permits deletion and not overwriting of properties.",
1313913140
"githubID": "GHSA-xxjr-mmjv-4gpg",
1314013141
"CVE": [
13141-
"CVE-2025-13465"
13142+
"CVE-2025-13465",
13143+
"CVE-2026-2950"
1314213144
]
1314313145
},
1314413146
"details": "### Impact\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. \n\nThe issue permits deletion of properties but does not allow overwriting their original behavior. \n\n### Patches\n\nThis issue is patched on 4.17.23.",
@@ -13158,6 +13160,7 @@
1315813160
"summary": "Lodash 4.17.23 and earlier are vulnerable to a prototype pollution bypass in _.unset and _.omit. The fix for CVE-2025-13465 only guards against string key members, so attackers can bypass it by passing array-wrapped path segments to delete properties from built-in prototypes including Object.prototype, Number.prototype, and String.prototype.",
1315913161
"githubID": "GHSA-f23m-r3pf-42rh",
1316013162
"CVE": [
13163+
"CVE-2025-13465",
1316113164
"CVE-2026-2950"
1316213165
]
1316313166
},
@@ -13178,6 +13181,7 @@
1317813181
"summary": "Lodash _.template is vulnerable to code injection via unsanitized options.imports key names. Untrusted key names are passed to the Function() constructor sink without validation, and the use of assignInWith (which enumerates inherited properties) also means that pre-existing prototype pollution on Object.prototype can flow into the Function() sink and execute arbitrary code at template compilation time.",
1317913182
"githubID": "GHSA-r5fr-rjxr-66jc",
1318013183
"CVE": [
13184+
"CVE-2021-23337",
1318113185
"CVE-2026-4800"
1318213186
]
1318313187
},

‎repository/jsrepository-v6.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13064,7 +13064,8 @@
1306413064
"identifiers": {
1306513065
"summary": "Command Injection in lodash",
1306613066
"CVE": [
13067-
"CVE-2021-23337"
13067+
"CVE-2021-23337",
13068+
"CVE-2026-4800"
1306813069
],
1306913070
"githubID": "GHSA-35jh-r3h4-6jhm"
1307013071
},
@@ -13137,7 +13138,8 @@
1313713138
"summary": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths to delete methods from global prototypes such as Object.prototype, though the issue only permits deletion and not overwriting of properties.",
1313813139
"githubID": "GHSA-xxjr-mmjv-4gpg",
1313913140
"CVE": [
13140-
"CVE-2025-13465"
13141+
"CVE-2025-13465",
13142+
"CVE-2026-2950"
1314113143
]
1314213144
},
1314313145
"details": "### Impact\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the `_.unset` and `_.omit` functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. \n\nThe issue permits deletion of properties but does not allow overwriting their original behavior. \n\n### Patches\n\nThis issue is patched on 4.17.23.",
@@ -13157,6 +13159,7 @@
1315713159
"summary": "Lodash 4.17.23 and earlier are vulnerable to a prototype pollution bypass in _.unset and _.omit. The fix for CVE-2025-13465 only guards against string key members, so attackers can bypass it by passing array-wrapped path segments to delete properties from built-in prototypes including Object.prototype, Number.prototype, and String.prototype.",
1315813160
"githubID": "GHSA-f23m-r3pf-42rh",
1315913161
"CVE": [
13162+
"CVE-2025-13465",
1316013163
"CVE-2026-2950"
1316113164
]
1316213165
},
@@ -13177,6 +13180,7 @@
1317713180
"summary": "Lodash _.template is vulnerable to code injection via unsanitized options.imports key names. Untrusted key names are passed to the Function() constructor sink without validation, and the use of assignInWith (which enumerates inherited properties) also means that pre-existing prototype pollution on Object.prototype can flow into the Function() sink and execute arbitrary code at template compilation time.",
1317813181
"githubID": "GHSA-r5fr-rjxr-66jc",
1317913182
"CVE": [
13183+
"CVE-2021-23337",
1318013184
"CVE-2026-4800"
1318113185
]
1318213186
},

‎repository/jsrepository.json‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12549,7 +12549,8 @@
1254912549
"identifiers": {
1255012550
"summary": "Command Injection in lodash",
1255112551
"CVE": [
12552-
"CVE-2021-23337"
12552+
"CVE-2021-23337",
12553+
"CVE-2026-4800"
1255312554
],
1255412555
"githubID": "GHSA-35jh-r3h4-6jhm"
1255512556
},
@@ -12622,7 +12623,8 @@
1262212623
"summary": "Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths to delete methods from global prototypes such as Object.prototype, though the issue only permits deletion and not overwriting of properties.",
1262312624
"githubID": "GHSA-xxjr-mmjv-4gpg",
1262412625
"CVE": [
12625-
"CVE-2025-13465"
12626+
"CVE-2025-13465",
12627+
"CVE-2026-2950"
1262612628
]
1262712629
},
1262812630
"info": [
@@ -12641,6 +12643,7 @@
1264112643
"summary": "Lodash 4.17.23 and earlier are vulnerable to a prototype pollution bypass in _.unset and _.omit. The fix for CVE-2025-13465 only guards against string key members, so attackers can bypass it by passing array-wrapped path segments to delete properties from built-in prototypes including Object.prototype, Number.prototype, and String.prototype.",
1264212644
"githubID": "GHSA-f23m-r3pf-42rh",
1264312645
"CVE": [
12646+
"CVE-2025-13465",
1264412647
"CVE-2026-2950"
1264512648
]
1264612649
},
@@ -12660,6 +12663,7 @@
1266012663
"summary": "Lodash _.template is vulnerable to code injection via unsanitized options.imports key names. Untrusted key names are passed to the Function() constructor sink without validation, and the use of assignInWith (which enumerates inherited properties) also means that pre-existing prototype pollution on Object.prototype can flow into the Function() sink and execute arbitrary code at template compilation time.",
1266112664
"githubID": "GHSA-r5fr-rjxr-66jc",
1266212665
"CVE": [
12666+
"CVE-2021-23337",
1266312667
"CVE-2026-4800"
1266412668
]
1266512669
},

0 commit comments

Comments
 (0)