Prototype Pollution and Command Injection in lodash as High Risk
cherrelleM1 opened this issue · 1 comments
cherrelleM1 commented
Current behaviour 💣
The Github Dependabot alerts cannot update lodash package.
GHSA-p6mc-m468-83gw
Expected behaviour ☀️
The Github Dependabot alerts should be able to update.
Reproduction Example 👾
On github, go to security tab.
Environment 🖥
Node.js v16.13.2
win32 10.0.18363
8.3.2
"html-webpack-plugin": "^5.5.0",
alexander-akait commented
Fixed on lodash side, please update your deps, sorry for a logn answer