{"cve":"CVE-2023-26145","nvd":{"published":"2023-09-28T05:15:45.843","modified":"2026-06-17T05:42:46.733","status":"Modified","description":"This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to target a nested Python object, relative to the original source object. These paths can be used to target internal class attributes and dict items, to retrieve, modify or invoke nested Python objects.\r\r**Note:**\r\rThe pydash.objects.invoke() method is vulnerable to Command Injection when the following prerequisites are satisfied:\r\r1) The source object (argument 1) is not a built-in object such as list/dict (otherwise, the __init__.__globals__ path is not accessible)\r\r2) The attacker has control over argument 2 (the path string) and argument 3 (the argument to pass to the invoked method)\r\r\rThe pydash.collections.invoke_map() method is also vulnerable, but is harder to exploit as the attacker does not have direct control over the argument to be passed to the invoked function.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.1},"cwes":["CWE-77","CWE-94","CWE-78"],"references":["https://gist.github.com/CalumHutton/45d33e9ea55bf4953b3b31c84703dfca","https://github.com/dgilland/pydash/commit/6ff0831ad285fff937cafd2a853f20cc9ae92021","https://security.snyk.io/vuln/SNYK-PYTHON-PYDASH-5916518","https://gist.github.com/CalumHutton/45d33e9ea55bf4953b3b31c84703dfca","https://github.com/dgilland/pydash/commit/6ff0831ad285fff937cafd2a853f20cc9ae92021"],"products":["derrickgilland:pydash"],"source":"nvd","synced_at":"2026-10-19T21:39:34.467980132+00:00"},"epss":{"cve":"CVE-2023-26145","score":0.03595,"percentile":0.89446,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-8mjr-6c96-39w8","url":"https://osv.dev/vulnerability/GHSA-8mjr-6c96-39w8","summary":"pydash Command Injection vulnerability","modified":"2024-10-21T21:01:08.062490Z","packages":[{"ecosystem":"PyPI","name":"pydash","purl":"pkg:pypi/pydash","ranges":["<6.0.0"],"fixed":["6.0.0"]}]},{"id":"PYSEC-2023-179","url":"https://osv.dev/vulnerability/PYSEC-2023-179","summary":"","modified":"2026-06-10T17:02:30.657082904Z","packages":[{"ecosystem":"PyPI","name":"pydash","purl":"pkg:pypi/pydash","ranges":["<6.0.0"],"fixed":["6.0.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}