Impact
What kind of vulnerability is it? Who is impacted?
An injection vulnerability been know to exist in lodash for a period of 2 months, this does not affect any users since we do not utilise templates (neither to dependencies) or lodash directly.
Patches
Has the problem been patched? What versions should users upgrade to?
This dependency has been updated to resolve the issue, you can manually upgrade the dependency yourself or get the new release to resolve the issue.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Manually updating the lodash package will resolve the issue, refer to npm documentation.
References
Are there any links users can visit to find out more?
See an example of the vulnerability and more information on Snyk
For more information
If you have any questions or comments about this advisory:
Impact
What kind of vulnerability is it? Who is impacted?
An injection vulnerability been know to exist in lodash for a period of 2 months, this does not affect any users since we do not utilise templates (neither to dependencies) or lodash directly.
Patches
Has the problem been patched? What versions should users upgrade to?
This dependency has been updated to resolve the issue, you can manually upgrade the dependency yourself or get the new release to resolve the issue.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Manually updating the lodash package will resolve the issue, refer to npm documentation.
References
Are there any links users can visit to find out more?
See an example of the vulnerability and more information on Snyk
For more information
If you have any questions or comments about this advisory: