Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] Command Injection in lodash #661

Closed
Amzani opened this issue May 7, 2024 · 1 comment · Fixed by #662
Closed

[Security] Command Injection in lodash #661

Amzani opened this issue May 7, 2024 · 1 comment · Fixed by #662
Labels
enhancement New feature or request

Comments

@Amzani
Copy link

Amzani commented May 7, 2024

Describe the bug
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

To Reproduce
run npm audit

lodash.template  *
Severity: high
Command Injection in lodash - https://github.com/advisories/GHSA-35jh-r3h4-6jhm
fix available via `npm audit fix --force`
Will install oclif@3.17.2, which is a breaking change
node_modules/@oclif/plugin-help/node_modules/lodash.template
node_modules/@oclif/plugin-not-found/node_modules/lodash.template
node_modules/@oclif/plugin-warn-if-update-available/node_modules/lodash.template
node_modules/lodash.template
  @oclif/plugin-commands  >=3.0.1
  Depends on vulnerable versions of lodash.template
  node_modules/@oclif/plugin-not-found/node_modules/@oclif/plugin-commands
  @oclif/plugin-warn-if-update-available  1.7.0 || 2.0.0 || >=2.1.0
  Depends on vulnerable versions of lodash.template
  node_modules/@oclif/plugin-help/node_modules/@oclif/plugin-warn-if-update-available
  node_modules/@oclif/plugin-not-found/node_modules/@oclif/plugin-warn-if-update-available
  node_modules/@oclif/plugin-warn-if-update-available
  node_modules/@oclif/plugin-warn-if-update-available/node_modules/@oclif/plugin-warn-if-update-available
    oclif  >=4.0.0-beta.1
    Depends on vulnerable versions of @oclif/plugin-warn-if-update-available
    Depends on vulnerable versions of lodash.template
    node_modules/@oclif/plugin-help/node_modules/oclif
    node_modules/@oclif/plugin-not-found/node_modules/oclif
    node_modules/@oclif/plugin-warn-if-update-available/node_modules/oclif
    node_modules/oclif

Expected behavior
upgrade lodash.template

Additional context
Add any other context about the problem here.

Copy link

git2gus bot commented May 7, 2024

This issue has been linked to a new work item: W-15703211

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants