Lodash: version with known vulnerabilities

best_practices.vulnerable_libraries.lodash

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, vulnerable libraries

What the rule checks

Scope. Applies to pages on which the library is detected: its window global (with its version field) or, for jQuery, Bootstrap, AngularJS, Lodash and Handlebars, a script URL whose path names the library and a version.

Expectation. Fails for every Lodash below 4.18.0; 4.18.0 and later pass. Detected through `_.VERSION` together with `_.runInContext` (Lodash-only; without it `_` is Underscore) or a script path naming lodash with a version. A page without the library: not applicable. A page that breaks the detection scripts (result missing or malformed) is not run for every library, never clean.

Source. retire.js jsrepository-v4.json (GitHub/NVD advisories), reviewed 2026-10-26; CVE-2021-23337, CVE-2025-13465, CVE-2026-2950, CVE-2026-4800 (< 4.18.0)

Detection: analyze_vulnerable_libraries; needs dom.

Failing example

The check reports a violation here. Corpus case vulnerable_libs_boundaries_last_vulnerable. The page may contain further findings for other rules.

vulnerable_libs_boundaries_last_vulnerable.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Last vulnerable releases</title>
  <script>
    window.jQuery = { fn: { jquery: "3.4.1" } };
    window.bootstrap = { Tooltip: { VERSION: "4.3.0" } };
    window.Handlebars = { VERSION: "4.7.9" };
    window._ = { VERSION: "4.17.23", runInContext: function () {} };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>Last vulnerable releases</h1>

  </main>
</body>
</html>

Passing example

The check passes here and reports nothing. Corpus case vulnerable_libs_boundaries_first_safe. The page may contain further findings for other rules.

vulnerable_libs_boundaries_first_safe.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>First fixed releases</title>
  <script>
    window.jQuery = { fn: { jquery: "3.5.0" } };
    window.bootstrap = { Tooltip: { VERSION: "4.3.1" } };
    window.Handlebars = { VERSION: "4.7.10" };
    window._ = { VERSION: "4.18.0", runInContext: function () {} };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>First fixed releases</h1>

  </main>
</body>
</html>

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.