We have ABP's audit-logging package which is dependent on lodash as seen below: @volo/audit-logging@10.1.0 (direct dependency) in package.json:90 @volo/abp.aspnetcore.mvc.ui.theme.commercial@10.1.0 in yarn.lock:5502 @abp/aspnetcore.mvc.ui.theme.shared@10.1.0 in yarn.lock:5 @abp/lodash@10.1.0 in yarn.lock:125 lodash@4.17.23 in yarn.lock:9506
lodash 4.17.23 has 2 known security vulnerabilities, both patched in >=4.18.0:
Severity Issue Advisory
High Code Injection via _.template imports key names npmjs.com/advisories/1115806
Moderate Prototype Pollution via array path bypass in _.unset and _.omit npmjs.com/advisories/1115810
When will ABP ship with a version of Lodash that has those vulnerabilities patched?
1 Answer(s)
-
0
Hi,
Both advisories are fixed in lodash
4.18.0+.@abp/lodashalready allows any 4.x ("lodash": "^4.17.21"), so you can force the safe version in your own project right now:- Add a resolution in your root
package.json(useoverridesfor npm/pnpm):
{ "resolutions": { "lodash": "^4.18.1" } }- Re-install and refresh the libs folder:
yarn install abp install-libsabp install-libscopies the physical files fromnode_modulesintowwwroot/libs, so once lodash is bumped there, yourwwwroot/libs/lodash/lodash.min.jswill be the patched version and both advisories should clear.We'll also raise the floor in
@abp/lodashfor future releases.Thanks
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post) - Add a resolution in your root
