Vulnerability report for oclif/oclif

Vulnerabilities

1 via 2 paths

289

high severity

Vulnerable module: lodash.template
Introduced through: lodash.template@4.5.0 and @oclif/plugin-warn-if-update-available@3.0.15

Introduced through: oclif@oclif/oclif#7e2a62401053061f189404b34b3670013c8f72b5 › lodash.template@4.5.0
Introduced through: oclif@oclif/oclif#7e2a62401053061f189404b34b3670013c8f72b5 › @oclif/plugin-warn-if-update-available@3.0.15 › lodash.template@4.5.0

lodash.template is a The Lodash method _.template exported as a Node.js module.

Affected versions of this package are vulnerable to Command Injection via template.

var _ = require('lodash');

_.template('', { variable: '){console.log(process.env)}; with(obj' })()

There is no fixed version for lodash.template.