Regular Expression Denial of Service (ReDoS) in lodash

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Steps to reproduce (provided by reporter Liyuan Chen): ```js var lo = require('lodash');

function buildblank(n) { var ret = 1 for (var i = 0; i < n; i++) { ret += " } return ret +1"; } var s = buildblank(50000) var time0 = Date.now(); lo.trim(s) var timecost0 = Date.now() - time0; console.log("timecost0: + time_cost0); var time1 = Date.now(); lo.toNumber(s) var time_cost1 = Date.now() - time1; console.log(timecost1: " + timecost1); var time2 = Date.now(); lo.trimEnd(s); var timecost2 = Date.now() - time2; console.log("timecost2: " + time_cost2); ```

Command Injection in lodash

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Withdrawn: Arbitrary code execution in lodash

Withdrawn

GitHub has chosen to publish this CVE as a withdrawn advisory due to it not being a security issue. See this issue for more details.

CVE description

"** DISPUTED ** A command injection vulnerability in Lodash 4.17.21 allows attackers to achieve arbitrary code execution via the template function. This is a different parameter, method, and version than CVE-2021-23337. NOTE: the vendor's position is that it's the developer's responsibility to ensure that a template does not evaluate code that originates from untrusted input.

Prototype Pollution in lodash

Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.

This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

Impact

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

Patches

This issue is patched on 4.17.23.

Allocation of Resources Without Limits or Throttling

Prototype pollution attack (lodash)