There are 3 open security issues in buster.
3 issues left for the package maintainer to handle:
- CVE-2020-28500:
(needs triaging)
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
- CVE-2020-8203:
(needs triaging)
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
- CVE-2021-23337:
(needs triaging)
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/n/node-lodash.png){kind=link}