[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.debounce:4.0.8

Open

#3 opened on Jan 2, 2019 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Needs clarification
Activity status: Stale
Tech stack: javascript, react, webpack
Domain: build-system, frontend, security

Research direction

Start by tracing the dependency chain from react-scripts through webpack, watchpack, and chokidar to lodash.debounce:4.0.8. Determine how the vulnerable transitive dependency can be removed or upgraded without breaking the sample app, then verify that dependency scanning no longer reports the listed vulnerabilities.

Written by the indexing model from the issue text.

Description

Vulnerabilities

DepShield reports that this application's usage of lodash.debounce:4.0.8 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
(CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.debounce:4.0.8 is a transitive dependency introduced by the following direct dependency(s):

• react-scripts:1.0.13
        └─ webpack:3.5.1
              └─ watchpack:1.6.0
                    └─ chokidar:2.0.4
                          └─ lodash.debounce:4.0.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Dominant language: JavaScript
Stars: 0
Forks: 0
PR merge metrics: No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

[Duplicate Code] Repeated filtered model-alias assembly in proxy server Open

code-quality refactoring

Difficulty 2/5 1-3 hours Newbie friendliness 84/100

github/gh-aw-firewall#8816 · Opened Sep 20, 2026
quickjs: support `timeout=None` (no per-call deadline) in `CodeInterpreterMiddleware` Open

integration:quickjs org:external priority:backlog topic:code-interpreter topic:middleware type:feature

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

langchain-ai/deepagents#6450 · Opened Sep 20, 2026
[optimization:agents-md-curator] AGENTS.md: compress duplicated Debugging & Logging section and merge redundant autopilot rules Open

optimization optimization:agents-md-curator

Difficulty 2/5 1-3 hours Newbie friendliness 86/100

githubnext/gh-aw-cao#13143 · Opened Sep 20, 2026
[BUG] schema-compat/zodToJsonSchema: nullable zod v4 enum/literal widens to type:[X,"null"] but keeps enum/const, so exported schema rejects null Open

status: needs triage

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

mastra-ai/mastra#24516 · 2 comments · Opened Sep 20, 2026
Kubernetes request flow diagram 404s on both copies of the tutorial Open

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

layer5io/docs#1263 · Opened Sep 20, 2026

More JavaScript issues