{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"4.0.0","last_affected":"4.5.1"}],"component":"lodash.trim","cve_ids":["CVE-2020-28500"],"ecosystem":"npm","epss":0.07336,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-29mw-wpgm-hmr9","id":"tcs_01M5KEFWN0AMKMQMBM0YV6TYJM","modified_at":"2025-09-29T21:12:31.102523Z","published_at":"2022-01-06T20:30:46Z","references":["https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9","https://nvd.nist.gov/vuln/detail/CVE-2020-28500","https://github.com/github/advisory-database/pull/6139","https://github.com/lodash/lodash/pull/5065","https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7","https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://snyk.io/vuln/SNYK-JS-LODASH-1018905","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-28500.yml","https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8","https://github.com/lodash/lodash","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-29mw-wpgm-hmr9#npm/lodash.trim","url":"https://osv.dev/vulnerability/GHSA-29mw-wpgm-hmr9"}],"summary":"Regular Expression Denial of Service (ReDoS) in lodash"}