Sploitus

11 exploited vulnerabilities in Lodash

Vulnerabilities with publicly known exploits

Vendors
Atlassian, Linux Mint, Rocky Linux, Canonical, Lodash, Unknown
With known exploits
11
Affected Lodash versions
< 4.18.0, 4.17.12, 4.17.21, 4.17.20, 4.17.11, 4.17.5
Affected Lodash Lodash-amd versions
< 4.18.0
Affected Lodash Lodash-es versions
< 4.18.0
Affected Lodash Lodash.template versions
< 4.18.0

Vulnerabilities with exploits

Highest CVSS first — 4 of these already have exploit code on Sploitus

CVE-2026-4800
CVSS 9.8 CRITICAL 2021-05-06FIX AVAILABLE
CVE-2026-2950
CVSS 9.8 CRITICAL 2025-12-05FIX AVAILABLE
CVE-2024-38986
CVSS 9.8 CRITICAL 2024-07-30
CVE-2019-10744 1 exploit
CVSS 9.1 CRITICAL 2019-07-04FIX AVAILABLE
Lodash-CVE-poc
CVE-2025-13465
CVSS 8.2 HIGH 2025-01-01FIX AVAILABLE
CVE-2020-28500
CVSS 7.5 HIGH 2021-02-15FIX AVAILABLE
CVE-2020-8203
CVSS 7.4 HIGH 2020-04-28FIX AVAILABLE
CVE-2021-23337 2 exploits
CVSS 7.2 HIGH 2021-02-15FIX AVAILABLE
patchtriageLodash-CVE-poc
CVE-2018-16487 2 exploits
CVSS 6.8 MEDIUM 2018-10-30FIX AVAILABLE
Lodash-CVE-pocTrivy - A Simple And Comprehensive Vulnerability Scanner For Containers, Suitable For CI
CVE-2019-1010266
CVSS 6.5 MEDIUM 2019-07-17FIX AVAILABLE
CVE-2018-3721 2 exploits
CVSS 6.5 MEDIUM 2018-06-07FIX AVAILABLE
Lodash-CVE-pocTrivy - A Simple And Comprehensive Vulnerability Scanner For Containers, Suitable For CI