lodash (npm)
A modern JavaScript utility library delivering modularity, performance, & extras.
Advisories
20
Latest version
4.18.1
Released Apr 1, 2026
License
MIT
OpenSSF Scorecard
7.5 / 10
How to fix
Upgrading to 4.18.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install lodash@4.18.1yarn
yarn add lodash@4.18.1pnpm
pnpm add lodash@4.18.1Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names |
Critical EPSS 2.81% |
>= 4.0.0, <= 4.17.23 | No fix yet |
| GHSA-r5fr-rjxr-66jc lodash vulnerable to Code Injection via `_.template` imports key names |
Critical EPSS 2.81% |
>= 4.0.0, < 4.18.0 | 4.18.0 |
| GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` |
Medium EPSS 0.34% |
<= 4.17.23 | No fix yet |
| GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` |
Medium EPSS 0.34% |
< 4.18.0 | 4.18.0 |
| GHSA-xxjr-mmjv-4gpg Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions |
Medium EPSS 1.82% |
>= 4.0.0, <= 4.17.22 | No fix yet |
| GHSA-xxjr-mmjv-4gpg Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions |
Medium EPSS 1.82% |
>= 4.0.0, < 4.17.23 | 4.17.23 |
| GHSA-29mw-wpgm-hmr9 Regular Expression Denial of Service (ReDoS) in lodash |
Medium EPSS 7.34% |
>= 4.0.0, < 4.17.21 | 4.17.21 |
| GHSA-29mw-wpgm-hmr9 Regular Expression Denial of Service (ReDoS) in lodash |
Medium EPSS 7.34% |
>= 4.0.0, < 4.17.21 | 4.17.21 |
| GHSA-35jh-r3h4-6jhm Command Injection in lodash |
High EPSS 21.33% |
< 4.17.21 | 4.17.21 |
| GHSA-35jh-r3h4-6jhm Command Injection in lodash |
High EPSS 21.33% |
< 4.17.21 | 4.17.21 |
| GHSA-p6mc-m468-83gw Prototype Pollution in lodash |
High EPSS 5.21% |
>= 3.7.0, < 4.17.19 | 4.17.19 |
| GHSA-p6mc-m468-83gw Prototype Pollution in lodash |
High EPSS 5.21% |
>= 3.7.0, < 4.17.19 | 4.17.19 |
| GHSA-x5rq-j2xg-h7qm Regular Expression Denial of Service (ReDoS) in lodash |
Medium EPSS 3.04% |
>= 4.7.0, < 4.17.11 | 4.17.11 |
| GHSA-x5rq-j2xg-h7qm Regular Expression Denial of Service (ReDoS) in lodash |
Medium EPSS 3.04% |
>= 4.7.0, < 4.17.11 | 4.17.11 |
| GHSA-jf85-cpcp-j695 Prototype Pollution in lodash |
Critical EPSS 5.01% |
< 4.17.12 | 4.17.12 |
| GHSA-jf85-cpcp-j695 Prototype Pollution in lodash |
Critical EPSS 5.01% |
< 4.17.12 | 4.17.12 |
| GHSA-4xc9-xhrj-v574 Prototype Pollution in lodash |
High EPSS 1.49% |
< 4.17.11 | 4.17.11 |
| GHSA-4xc9-xhrj-v574 Prototype Pollution in lodash |
High EPSS 1.49% |
< 4.17.11 | 4.17.11 |
| GHSA-fvqr-27wr-82fm Prototype Pollution in lodash |
Medium EPSS 2.35% |
< 4.17.5 | 4.17.5 |
| GHSA-fvqr-27wr-82fm Prototype Pollution in lodash |
Medium EPSS 2.35% |
< 4.17.5 | 4.17.5 |
Source: git+https://github.com/lodash/lodash.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor