Lodash vulnerability (1523)

What's going wrong?

A Lodash security issue there:
https://www.npmjs.com/advisories/1523

Version concerned: lodash@4.17.15

Current discussion:
https://github.com/lodash/lodash/issues/4837

Current fix (not published to NPM yet):
https://github.com/lodash/lodash/compare/4.17.15...4.17.15-post

How could we reproduce this issue?

Run in your repo:

npm audit --production

We use pm2 to run services, I doubt we should be concerned with this as I think pm2 is not accessible (but I may be wrong?), can you confirm if this could be a security issue?

Not related to your binary, but this is how we fixed it in our repos, simply add a new dependency:

{
  "dependencies": {
    "lodash": "lodash/lodash#4.17.15-post"
  }
}

This should also fix nested packages if you use npm, I don't know about yarn and pnpm.

Start by running npm audit --production in the pm2 repository and inspect the dependency manifest for lodash@4.17.15 or nested lodash versions. Read npm advisory 1523 and the linked Lodash discussion to determine whether pm2 is affected and whether the proposed unpublished fix applies. Done means the impact and an appropriate dependency resolution are established.