Debian dla-4663 : libjs-lodash - security update

high Nessus Plugin ID 324594

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4663 advisory.

- ----------------------------------------------------------------------- Debian LTS Advisory DLA-4663-1 [email protected] https://www.debian.org/lts/security/ Utkarsh Gupta July 02, 2026 https://wiki.debian.org/LTS
- -----------------------------------------------------------------------

Package : node-lodash Version : 4.17.21+dfsg+~cs8.31.173-1+deb11u1 CVE ID : CVE-2025-13465 CVE-2026-2950 CVE-2026-4800 Debian Bug : 1126265

Several vulnerabilities were discovered in node-lodash, a Node.js module providing utility functions for common programming tasks.

CVE-2025-13465

Prototype pollution in the _.unset and _.omit functions. A crafted property path could be used to delete properties from built-in prototypes (such as Object.prototype), leading to availability and integrity issues.

CVE-2026-2950

An incomplete fix for CVE-2025-13465. The initial guard only handled string key members and the literal constructor.prototype sequence, so it could be bypassed using array-wrapped path segments (for example [['constructor'], ['keys']]), via constructor static methods, or from primitive roots, again allowing deletion of properties on shared built-in prototypes.

CVE-2026-4800

Code injection in the _.template function. An incomplete fix for CVE-2021-23337: the variable option was validated but the imports option key names were not. Untrusted input passed as imports key names could inject default-parameter expressions that execute arbitrary code at template compilation time via the same Function() constructor sink.

For Debian 11 bullseye, this problem has been fixed in version 4.17.21+dfsg+~cs8.31.173-1+deb11u1.

We recommend that you upgrade your node-lodash packages.

For the detailed security status of node-lodash please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/node-lodash

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the libjs-lodash packages.

Plugin Details

Severity: High

ID: 324594

File Name: debian_DLA-4663.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 7/1/2026

Updated: 7/1/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.49

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2021-23337

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2026-4800

CVSS v4

Risk Factor: High

Base Score: 7.9

Threat Score: 6.9

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

CVSS Score Source: CVE-2025-13465

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:node-lodash-packages, p-cpe:/a:debian:debian_linux:libjs-lodash, cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:node-lodash

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/2/2026

Vulnerability Publication Date: 2/15/2021

Reference Information

CVE: CVE-2021-23337, CVE-2025-13465, CVE-2026-2950, CVE-2026-4800

Detections

Analytics