Vendor
Lodash
10 known vulnerabilities in products by Lodash, 0 of them actively exploited (CISA KEV).
Key figures
10
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-4800 | lodash vulnerable to Code Injection via `_.template` imports key names | 8.1 | |
| High | CVE-2025-13465 | Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions | 5.3 | |
| Critical | CVE-2019-10744 | Snyk Lodash: security vulnerability | 9.1 | |
| High | CVE-2021-23337 | Command Injection | 7.2 | |
| High | CVE-2020-8203 | Lodash: Allocation of Resources Without Limits or Throttling | 7.4 | |
| Medium | CVE-2020-28500 | Regular Expression Denial of Service (ReDoS) | 5.3 | |
| Medium | CVE-2019-1010266 | Lodash: Uncontrolled Resource Consumption | 6.5 | |
| Medium | CVE-2018-3721 | HackerOne lodash node module: Modification of Assumed-Immutable Data (MAID) | 6.5 | |
| Medium | CVE-2018-16487 | HackerOne Lodash: Uncontrolled Resource Consumption | 5.6 | |
| Medium | CVE-2026-2950 | lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` | 6.5 |
Products
| Lodash | 10 | 0 |
| Lodash-amd | 3 | 0 |
| Lodash-es | 3 | 0 |