CVE-2020-28500

5.3

MEDIUMCVSS v3

Published

February 15, 2021

CVSS v2

5 MEDIUM

Affected

13 projects

Assigned by

[email protected]

Severity scale

010

Description

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

lodash

NPMLodash modular utilities.

< 4.17.21, >= 4.0.0, < 4.17.21NVD

lodash-es

NPMLodash exported as ES modules.

>= 4.0.0, < 4.17.21OSV

@types/lodash

NPM

More on this CVE

NVD↗GitHub Advisory↗

TypeScript definitions for lodash

< 4.17.21, >= 4.0.0, < 4.17.21NVD

lodash.trim

NPMThe Lodash method `_.trim` exported as a module.

>= 4.0.0, <= 4.5.1OSV

@snyk/lodash

NPM[Site](https://lodash.com/) | [Docs](https://lodash.com/docs) | [FP Guide](https://github.com/lodash/lodash/wiki/FP-Guide) | [Contributing](https://github.com/lodash/lodash/blob/master/.github/CONTRIBUTING.md) | [Wiki](https://github.com/lodash/lodash/wik

< 4.17.21, >= 4.0.0, < 4.17.21NVD

FGRibreau/lodash

GitHub:trumpet: My own version of lodash with extra mixins

< 4.17.21, >= 4.0.0, < 4.17.21NVD

@sailshq/lodash

NPMA fork of Lodash 3.10.x with ongoing maintenance from the Sails core team.

< 4.17.21, >= 4.0.0, < 4.17.21NVD

sailshq/lodash

GitHubA fork of Lodash 3.10.x with ongoing maintenance from the Sails core team. **There will be no changes or additions to existing usage. (That means no new features.)**

< 4.17.21, >= 4.0.0, < 4.17.21NVD

lodash.trimend

NPMThe Lodash method `_.trimEnd` exported as a module.

>= 4.0.0, <= 4.5.1OSV

treelinehq/lodash

GitHub

< 4.17.21, >= 4.0.0, < 4.17.21NVD

lodash/lodash

GitHubA modern JavaScript utility library delivering modularity, performance, & extras.

< 4.17.21, >= 4.0.0, < 4.17.21NVD