Lodash vulnerabilities
We track 1 vulnerability in Lodash products across 4 products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on March 31, 2026.
1vulnerabilities
1critical
0high
0exploited
9.8average CVSS score
Latest Lodash vulnerabilities
- 9.8 Critical severity
lodash: Improper Control of Generation of Code
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as o