Vendors / lodash Records 10 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 2
Exploited now lodash records in CISA KEV No lodash vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 48
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02808 · Published 2026-03-31 · Partial fix · 4.18.1, 4.18.0 CWE-94
Priority LOW 35
The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution.
CVSS 3.1 MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00337 · Published 2026-03-31 · Partial fix · 4.18.1, 4.18.0 CWE-1321
Open these records in search → All records by CVSS severity
2 2 6 0 0
