search

vercel / nextjs-portfolio-starter

Easily create a portfolio with Next.js and Markdown.
https://demo.vercel.blog
664 stars 263 forks source link

Command Injection Affecting lodash package, versions <4.17.21 #3

Closed marcelomatz closed 2 years ago

marcelomatz commented 3 years ago

Hello everyone. I identified that this repository uses Loadash in a version that has a security vulnerability.

Here have more information about this vulnerability > https://app.snyk.io/vuln/SNYK-JS-LODASH-1040724

In the Lodash repository there is a commit that talks about: Prevent command injection through _.template's variable option https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c

I think that this vulnerability could jeopardize some applications that are using the NextJS Portfolio Starter.

leerob commented 2 years ago

I don't see that value being used in the lockfile for the latest dependency upgrade 👍

https://github.com/vercel/nextjs-portfolio-starter/pull/9