Snyk vulnerability: Prototype Pollution (CVE-2025-13465) via lodash dependency

[ksadhwani]

Description

The package @twilio-paste/color-contrast-utils (^5.0.0) introduces a transitive dependency on lodash that is flagged by Snyk.

Vulnerability:

• CVE: CVE-2025-13465
• Snyk ID: SNYK-JS-LODASH-15053838
• CWE: CWE-1321 (Prototype Pollution)

Fixed version:

• lodash >= 4.17.23

Please update the transitive lodash dependency used by @twilio-paste/color-contrast-utils to a non-vulnerable version.

Environment:

• Package: @twilio-paste/color-contrast-utils@5.0.0
• Vulnerability scanner: Snyk

Link to Reproduction

https://www.npmjs.com/package/@twilio-paste/color-contrast-utils

Paste Core Version

5.0.0

[dosubot]

Hi @ksadhwani! I'm Dosu and I'm helping the Twilio Labs team.

To clarify, lodash (v4.17.21) is a direct dependency of @twilio-paste/color-contrast-utils, not a transitive one [1]. It's pinned at 4.17.21 in the package.json.

The fix for CVE-2025-13465 requires lodash >= 4.17.23, so updating the dependency version in the color-contrast-utils package.json and regenerating the lockfile should resolve the vulnerability. I didn't find any existing PRs or discussions in the repo addressing this CVE yet.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.