{"uid":"cap_nB9CzhyCeBM8Z3qNRxWGW","slug":"api-strale-io-de67d960","name":"CVE Vulnerability Lookup by Package and Version","description":"Look up known vulnerabilities for a package+version via OSV API. Supports npm, PyPI, Maven, Go, Cargo, NuGet. Returns CVEs with severity and fix versions.","url":"https://api.strale.io/x402/cve-lookup?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","required":["package_name","version"],"properties":{"version":{"type":"string"},"ecosystem":{"type":"string","description":"npm/pypi/maven/go/cargo/nuget"},"package_name":{"type":"string"}}},"responseSchema":{"recommendation":{"type":"string"},"vulnerabilities":{"type":"array"},"highest_severity":{"type":"string"},"total_vulnerabilities":{"type":"integer"}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"version":"4.17.20","ecosystem":"npm","package_name":"lodash"}}},"response":{"_meta":{"payment":{"method":"x402","price_usd":0.054000000000000006,"settlement_id":"0x74f74b4881276de0b5fb485e70d93dfeb4ed191ca21edbaa9772be3416a3849a"},"capability":"cve-lookup","latency_ms":281,"provenance":{"source":"osv.dev","fetched_at":"2026-06-16T01:24:43.026Z"}},"version":"4.17.20","ecosystem":"npm","package_name":"lodash","recommendation":"Update to 4.17.21 to fix known vulnerabilities.","vulnerabilities":[{"id":"GHSA-35jh-r3h4-6jhm","aliases":["CVE-2021-23337"],"summary":"Command Injection in lodash","fixed_in":"4.17.21","modified":"2025-08-12T21:55:57.719943Z","severity":"high","published":"2021-05-06T16:05:51Z","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://www.oracle.com/security-alerts/cpuoct2021.html"],"affected_versions":["0.10.0","0.7.0","0.8.1","0.8.2","0.9.0"]},{"id":"GHSA-r5fr-rjxr-66jc","aliases":["CVE-2026-4800"],"summary":"lodash vulnerable to Code Injection via `_.template` imports key names","fixed_in":"4.18.0","modified":"2026-04-02T17:29:57.498155673Z","severity":"high","published":"2026-04-01T23:51:12Z","references":["https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc","https://nvd.nist.gov/vuln/detail/CVE-2026-4800","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"],"affected_versions":[]},{"id":"GHSA-29mw-wpgm-hmr9","aliases":["CVE-2020-28500"],"summary":"Regular Expression Denial of Service (ReDoS) in lodash","fixed_in":"4.17.21","modified":"2025-09-29T21:12:31.102523Z","severity":"moderate","published":"2022-01-06T20:30:46Z","references":["https://nvd.nist.gov/vuln/detail/CVE-2020-28500","https://github.com/github/advisory-database/pull/6139","https://github.com/lodash/lodash/pull/5065"],"affected_versions":["4.0.0","4.11.2","4.12.0","4.13.1","4.14.1"]},{"id":"GHSA-f23m-r3pf-42rh","aliases":["CVE-2026-2950"],"summary":"lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`","fixed_in":"4.18.0","modified":"2026-04-02T17:29:51.565211556Z","severity":"moderate","published":"2026-04-01T23:50:27Z","references":["https://github.com/lodash/lodash/security/advisories/GHSA-f23m-r3pf-42rh","https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2026-2950"],"affected_versions":[]},{"id":"GHSA-xxjr-mmjv-4gpg","aliases":["CVE-2025-13465"],"summary":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","fixed_in":"4.17.23","modified":"2026-06-09T11:15:10.330415235Z","severity":"moderate","published":"2026-01-21T23:01:22Z","references":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81"],"affected_versions":[]}],"highest_severity":"high","total_vulnerabilities":5}},"exampleRequest":{"version":"4.17.20","ecosystem":"npm","package_name":"lodash"},"tags":["x402"],"displayCostAmount":"0.054001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.054001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.054","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.054","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_leZ0PjbDpUaXJCYfIL98k","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.054","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Look up known CVE vulnerabilities for a specific package and version using the OSV API, returning severity scores and fix versions.","exampleAgentPrompt":"Check if there are any known CVEs or security vulnerabilities in lodash version 4.17.20 on npm — I need severity levels and which versions fix the issues.","exampleUseCases":null,"resultDescription":"Returns a list of CVE identifiers for the specified package and version, including severity ratings (e.g. CVSS scores), affected version ranges, and recommended fix versions, sourced from the OSV database.","failureModes":["Package name or version not found in OSV database — returns empty vulnerability list","Invalid or unsupported ecosystem specified — may return error or empty results","Malformed version string causes no matches","Rate limiting or upstream OSV API unavailability — returns 5xx error","Missing required parameters (package_name or version) — returns 400 validation error"],"whenToPreferThis":"Use this endpoint when you need fast, structured CVE lookups for a specific package+version combination across major ecosystems (npm, PyPI, Maven, Go, Cargo, NuGet). Prefer it over manual OSV API calls when you want severity and fix-version data in a single, paid-but-simple request. Best for automated dependency auditing workflows or security-aware build pipelines.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T12:46:24.500Z","isFirstParty":false,"canonicalSlug":"api-strale-io-de67d960"}