dev package derived

{
  "input": {
    "body": {
      "name": "lodash",
      "version": "4.17.20",
      "ecosystem": "npm"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "asOf": "2026-10-08T16:18:31.547Z",
      "name": "lodash",
      "note": "Vulnerabilities are what OSV.dev lists for exactly lodash 4.17.20; none listed means none KNOWN to OSV, not that the code is safe. The same flaw published by two databases is one row; severity is the advisory's own label, never derived. Advisory data via OSV.dev; its sources include the GitHub Advisory Database and the PyPI Advisory Database (both CC-BY 4.0).",
      "source": "npm registry (registry.npmjs.org) + npm download counts (api.npmjs.org) + OSV.dev",
      "license": "MIT",
      "version": "4.17.20",
      "homepage": "https://lodash.com/",
      "isLatest": false,
      "ecosystem": "npm",
      "riskFlags": [
        "known_vulnerabilities",
        "high_or_critical_vulnerability",
        "newer_version_available"
      ],
      "deprecated": null,
      "osvRecords": 5,
      "repository": "https://github.com/lodash/lodash",
      "description": "Lodash modular utilities.",
      "publishedAt": "2020-08-13T16:53:54.152Z",
      "latestVersion": "4.18.1",
      "dependencyCount": 0,
      "vulnerabilities": [
        {
          "id": "GHSA-35jh-r3h4-6jhm",
          "url": "https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm",
          "aliases": [
            "CVE-2021-23337",
            "CVE-2026-4800",
            "GHSA-r5fr-rjxr-66jc"
          ],
          "fixedIn": [
            "4.17.21"
          ],
          "summary": "Command Injection in lodash",
          "severity": "HIGH",
          "published": "2021-05-06T16:05:51.000Z",
          "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "id": "GHSA-r5fr-rjxr-66jc",
          "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc",
          "aliases": [
            "CVE-2021-23337",
            "CVE-2026-4800",
            "GHSA-35jh-r3h4-6jhm"
          ],
          "fixedIn": [
            "4.18.0"
          ],
          "summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
          "severity": "HIGH",
          "published": "2026-04-01T23:51:12.000Z",
          "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
        },
        {
          "id": "GHSA-29mw-wpgm-hmr9",
          "url": "https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9",
          "aliases": [
            "CVE-2020-28500"
          ],
          "fixedIn": [
            "4.17.21"
          ],
          "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
          "severity": "MODERATE",
          "published": "2022-01-06T20:30:46.000Z",
          "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
        },
        {
          "id": "GHSA-f23m-r3pf-42rh",
          "url": "https://osv.dev/vulnerability/GHSA-f23m-r3pf-42rh",
          "aliases": [
            "CVE-2025-13465",
            "CVE-2026-2950",
            "GHSA-xxjr-mmjv-4gpg"
          ],
          "fixedIn": [
            "4.18.0"
          ],
          "summary": "lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`",
          "severity": "MODERATE",
          "published": "2026-04-01T23:50:27.000Z",
          "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
        },
        {
          "id": "GHSA-xxjr-mmjv-4gpg",
          "url": "https://osv.dev/vulnerability/GHSA-xxjr-mmjv-4gpg",
          "aliases": [
            "CVE-2025-13465",
            "CVE-2026-2950",
            "GHSA-f23m-r3pf-42rh"
          ],
          "fixedIn": [
            "4.17.23"
          ],
          "summary": "Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions",
          "severity": "MODERATE",
          "published": "2026-01-21T23:01:22.000Z",
          "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
        }
      ],
      "maintainersCount": 1,
      "downloadsLastWeek": 203122461,
      "latestPublishedAt": "2026-04-01T21:01:20.458Z",
      "vulnerabilityCount": 5,
      "daysSinceLatestRelease": 189
    }
  }
}