Hi,

node-lodash is affected by 3 open CVEs (CVE-2025-13465, CVE-2026-2950,
and CVE-2026-4800). This has been fixed in sid, forky, and bullseye.
Only bookworm and trixie remain, as shown in the tracker:

https://security-tracker.debian.org/tracker/source-package/node-lodash.

Attaching the debdiff for trixie -pu. I'll wait for your ACK before
uploading the package. Let me know if you have any questions or
concerns.


- u

Hi,

JavaScript is not my forte, so I may be up the wrong tree here. But in:

| if (key === '__proto__' &&
|     !hasOwnProperty.call(object, '__proto__')) {
|   return false;
}

Could it be that `object` here is always the original object, rather than
the object at the current point in the path, allowing a later `__proto__`
to slip through?

Thanks,

Hi Jonathan,

Interesting point. I was able to probably reproduce what you're
saying. "object" in that guard is the original root object, it's never
advanced as the loop walks the path. The hole is specific to __proto__
when the root carries an own __proto__ key. So only the __proto__
guard is affected and the impact is deletion, not assignment.

Note this is upstream's code as shipped in 4.18.0 (commit fe8d32e), so
it looks like a residual flaw in the upstream fix itself. I'll report
it upstream: the proper correction is to check ownership against the
current node during traversal rather than the root, I think?

The current patch, however, does fix the CVE at hand, I think - so
how'd you like to proceed? Do we land this (as is in other releases
now) and follow up when fixed upstream, or would you like to wait for
upstream to get back and incorporate those changes here first?


- u

Control: tag -1 = trixie confirmed

Yes, if we're right about the issue that sounds the appropriate fix. But I
agree this is better handled upstream.

I'll take the current fixes in case upstream is not responsive in time
before the point release, even though it's a while away yet.


Thanks,

package release.debian.org
tags 1141449 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: node-lodash
Version: 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1

Explanation: fix prototype pollution issues [CVE-2025-13465 CVE-2025-13465]; validate imports keys in _.template [CVE-2026-4800]

package release.debian.org
tags 1141449 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: node-lodash
Version: 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1

Explanation: fix prototype pollution issues [CVE-2025-13465 CVE-2025-13465]; validate imports keys in _.template [CVE-2026-4800]

Hi Jonathan,

Agreed. Filed https://github.com/lodash/lodash/issues/6263.

I'll follow up once this is handled upstream. Thanks a bunch.


- u