CVE-2023-22621-POC

CVE-2023-22621-POC CVE-2023-22621：利用电子邮件模板实现 SSTI 到 RCE，影响 Strapi 版本 return strapi.config.get'plugin.email'; ; const send = async options = return strapi.plugin'email'.provider.sendoptions; ; / fill subject, text and html using lodash template @param object emailOptions - to, from and replyto...

Lodash Template - Server-Side Template Injection (RCE)

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. id: CVE-2021-23337 info: name: Lodash Template - Server-Side Template Injection RCE author: DhiyaneshDk severity: high description: | Lodash versions prior to 4.17.21 are vulnerable to Command Injectio...

nextjs-lodash-cve-2025-13465-repro

이것은 create-next-app으로 부트스트랩된 Next.js 프로젝트입니다. 시작하기 먼저, 개발 서버를 실행하세요: root@kitploit: npm run dev or yarn dev or pnpm dev or bun dev 브라우저에서 http://localhost:3000를 열어 결과를 확인하세요. app/page.tsx 파일을 수정하여 페이지 편집을 시작할 수 있습니다. 파일을 편집하면 페이지가 자동으로 업데이트됩니다. 이 프로젝트는 Vercel의 새로운 글꼴 패밀리인 Geist를 자동으로 최적화하고 로드하기 위...

CVE-2026-4800-POC

CVE-2026-4800-POC セキュリティアドバイザリ https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc POC root@kitploit: const = require'lodash'; Object.prototype.imports = 'x=process.getBuiltinModule"childprocess".execSync"curl https://example.com"':undefined .template'', ; フロー...

Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0)

Summary Vulnerabilities exists in IBM Cloud Pak for Data System CPDS 1.0 addressed in 11.3.1.2-IF1 Vulnerability Details CVEID:CVE-2025-38527 DESCRIPTION: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifsoplockbreak A race condition can...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to deletion of properties (CVE-2025-13465)

Summary Undici is used by IBM Storage Fusion Data Foundation in components odf-console, noobaa-core. This bulletin identifies the steps to take to address the vulnerability in IBM Storage Fusion Data Foundation. CVE-2025-13465 Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash version...

CLSA-2026-1785468082 TuxCare security update for lodash-es (6 CVEs)

TuxCare rebuilt lodash-es to address 6 CVEs. Fixed in 4.17.15-tuxcare.1...

CLSA-2026-1785468076 TuxCare security update for lodash-es (7 CVEs)

TuxCare rebuilt lodash-es to address 7 CVEs. Fixed in 4.17.11-tuxcare.1...

CLSA-2026-1785291646 TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.5-tuxcare.3...

CLSA-2026-1784596286 TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 4.17.4-tuxcare.3...

CLSA-2026-1784509823 TuxCare security update for lodash (3 CVEs)

TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.4-tuxcare.2...

CLSA-2026-1784250515 TuxCare security update for lodash (2 CVEs)

TuxCare rebuilt lodash to address 2 CVEs. Fixed in 4.17.5-tuxcare.1...

CLSA-2026-1784250520 TuxCare security update for lodash (7 CVEs)

TuxCare rebuilt lodash to address 7 CVEs. Fixed in 4.17.11-tuxcare.1...

CLSA-2026-1777336764 TuxCare security update for lodash (8 CVEs)

TuxCare rebuilt lodash to address 8 CVEs. Fixed in 4.18.1-tuxcare.1...

CLSA-2026-1775262602 TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 2.4.2-tuxcare.1...

CLSA-2026-1775003201 TuxCare security update for lodash.set (5 CVEs)

TuxCare rebuilt lodash.set to address 5 CVEs. Fixed in 4.3.2-tuxcare.1...

CLSA-2026-1773188140 TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 3.10.1-tuxcare.2...

Malicious code in @404c3s4r/lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11434 Malicious code in @404c3s4r/lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...