Lucene search

K
githubGitHub Advisory DatabaseGHSA-8P5Q-J9M2-G8WR
HistoryDec 03, 2021 - 8:37 p.m.

Withdrawn: Arbitrary code execution in lodash

2021-12-0320:37:32
GitHub Advisory Database
github.com
115

Withdrawn

GitHub has chosen to publish this CVE as a withdrawn advisory due to it not being a security issue. See this issue for more details.

CVE description

"DISPUTED A command injection vulnerability in Lodash 4.17.21 allows attackers to achieve arbitrary code execution via the template function. This is a different parameter, method, and version than CVE-2021-23337. NOTE: the vendor’s position is that it’s the developer’s responsibility to ensure that a template does not evaluate code that originates from untrusted input.

CPENameOperatorVersion
lodashle4.17.21