Lodash Command Injection Vulnerability

A command injection vulnerability has been identified in Lodash versions prior to 4.17.21. The issue arises in the template function, where improper validation of key names allows for the execution of arbitrary code. This vulnerability is particularly concerning because it could lead to the disclosure of sensitive information, unauthorized data modification, or a denial-of-service condition.

Impact

Exploitation of this vulnerability could result in command injection, allowing attackers to execute arbitrary code in the context of the application.

Reproduction

To reproduce this vulnerability, use a version of Lodash prior to 4.17.21. The vulnerability can be triggered by calling the template function with a payload that includes malicious expressions in the variable key names. For example, injecting a variable name that, when executed, logs sensitive information such as environment variables.

Remediation

Upgrade Lodash to version 4.17.21 or later.