All the vulnerabilities related to the version 2.3.3 of the package
Command Injection in lodash
lodash
versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Prototype Pollution in merge
All versions of package merge <2.1.1 are vulnerable to Prototype Pollution via _recursiveMerge .