According to its self-reported version number, Lodash is prior to 4.18.0. It is, therefore, affected by multiple vulnerabilities:

- A code injection vulnerability in the _.template function. The validation added for CVE-2021-23337 to the variable option was not applied to options.imports key names, which are passed to the same Function() constructor sink. An attacker able to control these key names can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, inherited properties were merged into imports, allowing polluted Object.prototype keys to reach the sink. (CVE-2026-4800)

- A prototype pollution vulnerability in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guarded string path segments, an attacker can bypass it by wrapping path segments in arrays, allowing the deletion of properties from built-in prototypes such as Object.prototype, Number.prototype and String.prototype. The issue permits deletion of properties but does not allow overwriting their original behavior. (CVE-2026-2950)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and
    _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-
    xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing
    array-wrapped path segments. This allows deletion of properties from built-in prototypes such as
    Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype
    properties but does not allow overwriting their original behavior. Patches: This issue is patched in
    4.18.0. Workarounds: None. Upgrade to the patched version. (CVE-2026-2950)

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4663 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4663-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     July 02, 2026                               https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : node-lodash     Version        : 4.17.21+dfsg+~cs8.31.173-1+deb11u1     CVE ID         : CVE-2025-13465 CVE-2026-2950 CVE-2026-4800     Debian Bug     : 1126265

    Several vulnerabilities were discovered in node-lodash, a Node.js     module providing utility functions for common programming tasks.

    CVE-2025-13465

        Prototype pollution in the _.unset and _.omit functions. A         crafted property path could be used to delete properties from         built-in prototypes (such as Object.prototype), leading to         availability and integrity issues.

    CVE-2026-2950

        An incomplete fix for CVE-2025-13465. The initial guard only         handled string key members and the literal constructor.prototype         sequence, so it could be bypassed using array-wrapped path         segments (for example [['constructor'], ['keys']]), via         constructor static methods, or from primitive roots, again allowing         deletion of properties on shared built-in prototypes.

    CVE-2026-4800

        Code injection in the _.template function. An incomplete fix for         CVE-2021-23337: the variable option was validated but the         imports option key names were not. Untrusted input passed as         imports key names could inject default-parameter expressions that         execute arbitrary code at template compilation time via the same         Function() constructor sink.

    For Debian 11 bullseye, this problem has been fixed in version     4.17.21+dfsg+~cs8.31.173-1+deb11u1.

    We recommend that you upgrade your node-lodash packages.

    For the detailed security status of node-lodash please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-lodash

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and
    _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-     xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing     array-wrapped path segments. This allows deletion of properties from built-in prototypes such as     Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype     properties but does not allow overwriting their original behavior. Patches: This issue is patched in     4.18.0. Workarounds: None. Upgrade to the patched version. (CVE-2026-2950)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of IBM WebSphere eXtreme Scale installed on the remote host is prior to 8.6.2.2 IBM. It is, therefore, affected by multiple vulnerabilities as referenced in the 7282872 advisory.

  - Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
    (CVE-2021-23337)

  - Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation     for the variable option in _.template but did not apply the same validation to options.imports key names.
    Both paths flow into the same Function() constructor sink. When an application passes untrusted input as     options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary     code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which     enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector,     the polluted keys are copied into the imports object and passed to Function(). Patches: Users should     upgrade to version 4.18.0. Workarounds: Do not pass untrusted input as key names in options.imports. Only     use developer-controlled, static key names. (CVE-2026-4800)

  - Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and
    _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-     xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing     array-wrapped path segments. This allows deletion of properties from built-in prototypes such as     Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype     properties but does not allow overwriting their original behavior. Patches: This issue is patched in     4.18.0. Workarounds: None. Upgrade to the patched version. (CVE-2026-2950)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of IBM Cognos Analytics installed on the remote host is 12.0.4 prior to 12.0.4 FP3, or 12.1.x prior to 12.1.3 FP2. It is, therefore, affected by multiple vulnerabilities as referenced in the IBM Security Bulletin No.
7287209:

  - NLTK versions 3.9.2 and prior are vulnerable to arbitrary code execution due to improper input     validation in the StanfordSegmenter module. The module dynamically loads external Java .jar files     without verification or sandboxing. An attacker can supply or replace the JAR file, enabling the     execution of arbitrary Java bytecode at import time. (CVE-2026-0848)

  - The lodash fix for CVE-2021-23337 added validation for the variable option in _.template but did not     apply the same validation to options.imports key names. Both paths flow into the same Function()     constructor sink. When an application passes untrusted input as options.imports key names, an attacker     can inject default-parameter expressions that execute arbitrary code at template compilation time.
    (CVE-2026-4800)

  - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.
    From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python     buffers (e.g. Hash.update()), this could lead to buffer overflows. (CVE-2026-39892)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8411-1 advisory.

    It was discovered that Lodash was vulnerable to a prototype pollution issue in the zipObjectDeep function.
    An attacker could possibly use this issue to modify application behavior. This issue only affected Ubuntu     18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8203)

    Liyuan Chen discovered that Lodash was vulnerable to a regular expression denial of service issue in the     toNumber, trim, and trimEnd functions. An attacker could possibly use this issue to consume excessive     system resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu     20.04 LTS. (CVE-2020-28500)

    Marc Hassan discovered that Lodash did not properly sanitize input to the template function. An attacker     could possibly use this issue to inject and execute arbitrary commands. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-23337)

    It was discovered that Lodash was vulnerable to a prototype pollution issue in the unset and omit     functions. An attacker could possibly use this issue to delete properties from global prototypes,     resulting in security restrictions being bypassed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04     LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2025-13465)

    It was discovered that Lodash was vulnerable to a prototype pollution issue in the unset and omit     functions. An attacker could possibly use this issue to delete properties from built-in prototypes,     resulting in security restrictions being bypassed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04     LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-2950)

    It was discovered that Lodash did not properly validate certain inputs to the template function. An     attacker could possibly use this issue to inject malicious code during template processing, resulting in     arbitrary code execution. (CVE-2026-4800)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4820 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4820-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     October 05, 2026                            https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : node-lodash     Version        : 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1     CVE ID         : CVE-2025-13465 CVE-2026-2950 CVE-2026-4800     Debian Bug     : 1126265

    Several vulnerabilities were discovered in node-lodash, a Node.js     module providing utility functions for common programming tasks.

    CVE-2025-13465

        Prototype pollution in the _.unset and _.omit functions. A         crafted property path could be used to delete properties from         built-in prototypes (such as Object.prototype), leading to         availability and integrity issues.

    CVE-2026-2950

        An incomplete fix for CVE-2025-13465. The initial guard only         handled string key members and the literal constructor.prototype         sequence, so it could be bypassed using array-wrapped path         segments (for example [['constructor'], ['keys']]), via         constructor static methods, or from primitive roots, again allowing         deletion of properties on shared built-in prototypes.

    CVE-2026-4800

        Code injection in the _.template function. An incomplete fix for         CVE-2021-23337: the variable option was validated but the         imports option key names were not. Untrusted input passed as         imports key names could inject default-parameter expressions that         execute arbitrary code at template compilation time via the same         Function() constructor sink.

    For Debian 12 bookworm, these problems have been fixed in version     4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1.

    We recommend that you upgrade your node-lodash packages.

    For the detailed security status of node-lodash please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-lodash

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
115562	Lodash < 4.18.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	10/2/2026	10/2/2026	critical
439613	SCA: security update for lodash, lodash-amd, lodash-es, lodash.unset (GHSA-f23m-r3pf-42rh)	Tenable Cloud Security	SCA Checks	4/2/2026	7/2/2026	medium
439613	SCA: security update for lodash, lodash-amd, lodash-es, lodash.unset (GHSA-f23m-r3pf-42rh)	Tenable Self-Hosted Container Security	SCA Checks	4/2/2026	7/2/2026	medium
324594	Debian dla-4663 : libjs-lodash - security update	Nessus	Debian Local Security Checks	7/1/2026	7/1/2026	high
304822	Linux Distros Unpatched Vulnerability : CVE-2026-2950	Nessus	Misc.	4/4/2026	10/5/2026	medium
333386	IBM WebSphere eXtreme Scale 8.6.2.0 < 8.6.2.2 (7282872)	Nessus	Web Servers	8/8/2026	8/8/2026	high
347960	IBM Cognos Analytics 12.0.4 < 12.0.4 FP3 / 12.1.x < 12.1.3 FP2 Multiple Vulnerabilities (7287209)	Nessus	CGI abuses	9/18/2026	9/21/2026	high
320407	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Lodash vulnerabilities (USN-8411-1)	Nessus	Ubuntu Local Security Checks	6/11/2026	6/11/2026	high
362922	Debian dla-4820 : libjs-lodash - security update	Nessus	Debian Local Security Checks	10/5/2026	10/5/2026	high

Detections

Analytics

Plugins Search

critical

medium

medium

high

medium

high

high

high

high