npm

lodash-amd

Security advisories for lodash-amd, newest first. 3 known, all fixed. If you’re on 4.18.0 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

4.18.1

Advisories

3 · 0 unfixed

Last advisory

1 Apr 2026

Safe from

4.18.0

3 advisories · newest first

HIGH8.1 1 Apr 2026

lodash vulnerable to Code Injection via `_.template` imports key names

GHSA-r5fr-rjxr-66jc · CVE-2026-4800

Affected

≥ 4.0.0, < 4.18.0

Fixed in

4.18.0

Published

1 Apr 2026

MODERATE6.5 1 Apr 2026

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

GHSA-f23m-r3pf-42rh · CVE-2026-2950

Affected

< 4.18.0

Fixed in

4.18.0

Published

1 Apr 2026

MODERATE6.5 21 Jan 2026

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

GHSA-xxjr-mmjv-4gpg · CVE-2025-13465

Affected

≥ 4.0.0, < 4.17.23

Fixed in

4.17.23

Published

21 Jan 2026

/advisories/npm/lodash-amd/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →