[PR #159] [MERGED] fix: upgrade lodash to 4.18.0 (CVE-2026-4800) #3731

New Issue

2026-07-12T09:14:49-05:00

GiteaMirror commented

2026-07-12 09:14:49 -05:00

📋 Pull Request Information

Original PR: https://github.com/reconurge/flowsint/pull/159
Author: @orbisai0security
Created: 6/3/2026
Status: ✅ Merged
Merged: 6/20/2026
Merged by: @dextmorgn

Base: main ← Head: fix-cve-2026-4800-lodash

📝 Commits (1)

51e9cd5 fix: CVE-2026-4800 security vulnerability

📊 Changes

2 files changed (+6 additions, -0 deletions)

View changed files

📝 flowsint-app/package.json (+1 -0)
📝 yarn.lock (+5 -0)

📄 Description

Summary

Upgrade lodash from 4.17.21 to 4.18.0 to fix CVE-2026-4800.

Vulnerability

Field	Value
ID	CVE-2026-4800
Severity	HIGH
Scanner	trivy
Rule	`CVE-2026-4800`
File	`flowsint-app/yarn.lock`
Assessment	Likely exploitable

Description: lodash: lodash: Arbitrary code execution via untrusted input in template imports

Evidence

Scanner confirmation: trivy rule CVE-2026-4800 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

flowsint-app/package.json
flowsint-app/yarn.lock

Verification

Build passes
Scanner re-scan confirms fix
LLM code review passed

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

Automated security fix by OrbisAI Security

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/reconurge/flowsint/pull/159 **Author:** [@orbisai0security](https://github.com/orbisai0security) **Created:** 6/3/2026 **Status:** ✅ Merged **Merged:** 6/20/2026 **Merged by:** [@dextmorgn](https://github.com/dextmorgn) **Base:** `main` ← **Head:** `fix-cve-2026-4800-lodash` --- ### 📝 Commits (1) - [`51e9cd5`](https://github.com/reconurge/flowsint/commit/51e9cd51650aa3fa89703e4c530c6ef7ea1d2054) fix: CVE-2026-4800 security vulnerability ### 📊 Changes **2 files changed** (+6 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `flowsint-app/package.json` (+1 -0) 📝 `yarn.lock` (+5 -0) </details> ### 📄 Description ## Summary Upgrade lodash from 4.17.21 to 4.18.0 to fix CVE-2026-4800. ## Vulnerability | Field | Value | |-------|-------| | **ID** | CVE-2026-4800 | | **Severity** | HIGH | | **Scanner** | trivy | | **Rule** | `CVE-2026-4800` | | **File** | `flowsint-app/yarn.lock` | | **Assessment** | Likely exploitable | **Description**: lodash: lodash: Arbitrary code execution via untrusted input in template imports ## Evidence **Scanner confirmation**: trivy rule `CVE-2026-4800` flagged this pattern. **Production code**: This file is in the production codebase, not test-only code. ## Threat Model Context This is a Node.js library - vulnerabilities affect downstream consumers who use this package. ## Changes - `flowsint-app/package.json` - `flowsint-app/yarn.lock` ## Verification - [x] Build passes - [x] Scanner re-scan confirms fix - [x] LLM code review passed --- *This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.* --- *Automated security fix by [OrbisAI Security](https://orbisappsec.com)* --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-07-12 09:14:49 -05:00

GiteaMirror closed this issue

2026-07-12 09:14:50 -05:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/flowsint#3731