-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Format: 1.8 Date: Fri, 19 Jun 2026 15:42:11 +0530 Source: node-lodash Built-For-Profiles: noudeb Architecture: source Version: 4.17.21+dfsg+~cs8.31.173-1+deb11u1 Distribution: bullseye-security Urgency: high Maintainer: Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org> Changed-By: Utkarsh Gupta <utkarsh@debian.org> Closes: 1126265 Changes: node-lodash (4.17.21+dfsg+~cs8.31.173-1+deb11u1) bullseye-security; urgency=high . * Non-maintainer upload by the LTS team. * Add patch to prevent prototype pollution on baseUnset function. (Fixes: CVE-2025-13465) (Closes: #1126265) * Add patch to block prototype pollution in baseUnset via constructor/prototype traversal (array-wrapped path bypass of the CVE-2025-13465 fix). (Fixes: CVE-2026-2950) * Add patch to validate imports keys in _.template, preventing code injection via the Function() sink. (Fixes: CVE-2026-4800) * Add patch to update lodash-cli dependency map so the regenerated lodash.template module requires assignWith/arrayEach; without it the module throws "assignWith is not defined" at runtime (caught by the node-gulp-util autopkgtest). (Related: CVE-2026-4800) Checksums-Sha1: 8c1850495815508df285d246df55a838a870f4e7 3147 node-lodash_4.17.21+dfsg+~cs8.31.173-1+deb11u1.dsc 61f62ef33f5ff389f087ed5c489349093942dfb6 41560 node-lodash_4.17.21+dfsg+~cs8.31.173.orig-lodash-cli.tar.xz c2f82dcdcaddc2b83d47e59261ec0c170cceaed7 75612 node-lodash_4.17.21+dfsg+~cs8.31.173.orig-types-lodash.tar.xz 81762950fe8229618001fdb561378fc8f0981d4d 576176 node-lodash_4.17.21+dfsg+~cs8.31.173.orig.tar.xz 4b9e42fb28aee5cf851613a346e058260037938e 12460 node-lodash_4.17.21+dfsg+~cs8.31.173-1+deb11u1.debian.tar.xz 4c911ee7786cec38c056b32ad5ca18ff63f6dce9 6910 node-lodash_4.17.21+dfsg+~cs8.31.173-1+deb11u1_source.buildinfo Checksums-Sha256: 99fb7146d688a4b15e34ffd3057604e3c810929f9eb04550712971bfff933c04 3147 node-lodash_4.17.21+dfsg+~cs8.31.173-1+deb11u1.dsc 60211e46cf49a805fced79175317505a6337b440ea3e0e37a3b78ec7d3ce7366 41560 node-lodash_4.17.21+dfsg+~cs8.31.173.orig-lodash-cli.tar.xz 82fad02c44e7d4643eb6cff72b37fd31cd1985827147c7bc1fcce48db66e460a 75612 node-lodash_4.17.21+dfsg+~cs8.31.173.orig-types-lodash.tar.xz cd29276e76663f2eed86aa7adb3017fef7631777ac33f2355e19e1e07ad7f7a9 576176 node-lodash_4.17.21+dfsg+~cs8.31.173.orig.tar.xz 9544f79a7f5c045fd0a73437b1463384393c57f0863aa6cffe03b1538da9eeac 12460 node-lodash_4.17.21+dfsg+~cs8.31.173-1+deb11u1.debian.tar.xz d6de746c166f96c463412046feaa70cc9a2e626ec83336b1d86c38b049a0b2ea 6910 node-lodash_4.17.21+dfsg+~cs8.31.173-1+deb11u1_source.buildinfo Files: b48d9ffdb1522e61d8e3e0b60a089045 3147 javascript optional node-lodash_4.17.21+dfsg+~cs8.31.173-1+deb11u1.dsc b2217589333a9b2e1dd198bdfa1f3948 41560 javascript optional node-lodash_4.17.21+dfsg+~cs8.31.173.orig-lodash-cli.tar.xz ee87f94ababe513cb4a32a4480cc3eb1 75612 javascript optional node-lodash_4.17.21+dfsg+~cs8.31.173.orig-types-lodash.tar.xz 0dc3289b0bd047a1bb177476a1c2495a 576176 javascript optional node-lodash_4.17.21+dfsg+~cs8.31.173.orig.tar.xz bac8bbcc36a8e92132b3948480c47557 12460 javascript optional node-lodash_4.17.21+dfsg+~cs8.31.173-1+deb11u1.debian.tar.xz 489050a997818a3e4ffd0e17c46e0b60 6910 javascript optional node-lodash_4.17.21+dfsg+~cs8.31.173-1+deb11u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQJHBAEBCAAxFiEEbJ0QSEqa5Mw4X3xxgj6WdgbDS5YFAmpFiFgTHHV0a2Fyc2hA ZGViaWFuLm9yZwAKCRCCPpZ2BsNLli8sEADhZeaRHLXNVwnVWv3JaVgh0fjd31aN 2c3VrAEKPDyyLyBj01ohI+TzxnLvkd9+m8eipxj8z/PmBVNfrUjHXsGAQ7L70kJl 2Cx+wG9LXpaZElVQFWxVtxqz9Xzw3IufYMyMhpeFJwEhex+GVBHFXMWZcwNhFOIX KFpCPSDN7j7FMPTjnl35isceZCEpfQikUPQV5Wj5Ujaw3nfGeYRvynqdsvBGTc2d Ab72iAJndDvp8Y2MZ2c9oo2UvJdZmMfJa9ARkPdvlAd+dwmNg5bJeZDO8nohZUHa wrV1cVu4LgkltjIwDJcPV4fPi84JuIxUOe2XSmbcmWLmuS//VAnplSQiJFbZT+Pr D9ywoampX7G+YheK3zxqU7H4j2xycuvWwVReb8tuz8Q8DZKaaNZmPVci0zyNNd4N acCBieWj9LOwrlyIF33pr6sak2xWYIh+mVCdawYDxqklJrY5yFF7YyhvSfAx7bl9 KrIcTM81nO5geafuJUUpKK1grEi8NuPU402Jf0oVgzuWHu5F1leKMECkCCy4UREM /VfXzKpmWY0esZHrFTOq3oEk4DcK8ZaV3UMo00dpcQYnj6Ha1H/suXnYFW1nIE+l TYFOdCH1a8oSBwb8GtS/iZf8OD168chJoyud+Va1k2xTi+IiFjON2qUVYhxYv5+Z rh7YhcZ7QKEWrg== =+h6r -----END PGP SIGNATURE-----
