Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Security Vulnerability: Update lodash to >=4.17.12

See original GitHub issue

I’ve been seeing the following notices from npm audit over the past few months:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.11                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ searchkit                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ searchkit > lodash                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/782                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.12                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ searchkit                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ searchkit > lodash                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1065                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

I’m willing to update lodash but having a hard time determining how to contribute - any steps I should follow?

Issue Analytics

State:
Created 4 years ago
Comments:8 (6 by maintainers)

Top GitHub Comments

1reaction

benrobertsoniocommented, Nov 20, 2019

I actually just realized this is resolved in #684. Installing 2.3.1-alpha.9 version resolved the issue for me, but would really be nice to get that in a stable release.

0reactions

joemcelroycommented, Dec 29, 2019

this been bumped to searchkit@2.4

Top Results From Across the Web

lodash@4.17.12 - Snyk Vulnerability Database

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber , trim and trimEnd functions. POC....

Lodash Lodash : List of security vulnerabilities - CVE Details

# CVE ID CWE ID Vulnerability Type(s) Publish Date Update Date Score Gaine... 1 CVE‑2021‑23337 94 2021‑02‑15 2022‑09‑13 6.5 None 2 CVE‑2020‑28500 DoS 2021‑02‑15 2022‑09‑13...

How can I update only the lodash package a child dependent ...

This latest version of lodash has security vulnerability of Command Injection (CVE-2021-23337). https://cve.mitre.org/cgi-bin/cvename.cgi?name= ...

Update lodash to > 4.17.12 #4730 - cypress-io/cypress - GitHub

running npm audit shows a Prototype Pollution vulnerability, please update the lodash library to verions highter than 4.17.12 ...

Lodash < 4.17.12 Prototype Pollution - Vulners

According to its self-reported version number, Lodash is prior to 4.17.12. It is, therefore, affected by a prototype pollution vulnerability in the function ......