PYSEC-2023-179

This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke and pydash.collections.invokemap accept dotted paths Deep Path Strings to target a nested Python object, relative to the original source object. These paths can be used to target...

CVE-2023-26145

CVE-2023-26145 affects the Python package pydash prior to version 6.0.0 . Vulnerable are methods such as pydash.objects.invoke() and pydash.collections.invoke_map() , which accept dotted path strings to target nested objects. The issue is a potential Command Injection when prerequisites are met: ...