CVE-2020-28500

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Lodash versions before 4.18.0 do not properly validate key names in the options.imports option of _.template. An attacker can inject default-parameter expressions that execute arbitrary code during template compilation. Additionally, prototype pollution can lead to similar attacks.

Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guarded against string key members, but an attacker can bypass it by using array-wrapped path segments. This allows deletion of properties from built-in prototypes like Object.prototype.

A vulnerability in Lodash versions 4.0.0 through 4.17.22 allows prototype pollution via the _.unset and _.omit functions. An attacker can pass crafted paths that cause Lodash to delete methods from global prototypes.