Withdrawn

GitHub has chosen to publish this CVE as a withdrawn advisory due to it not being a security issue. See this issue for more details.

CVE description

"** DISPUTED ** A command injection vulnerability in Lodash 4.17.21 allows attackers to achieve arbitrary code execution via the template function. This is a different parameter, method, and version than CVE-2021-23337. NOTE: the vendor's position is that it's the developer's responsibility to ensure that a template does not evaluate code that originates from untrusted input.

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-23337
• https://nvd.nist.gov/vuln/detail/CVE-2021-41720
• https://github.com/lodash/lodash/issues/5261
• https://web.archive.org/web/20211004200531/https:/github.com/lodash/lodash/issues/5261