Security: [email protected] vulnerability (CVE-2026-4800) in semantic-ui-react dependency

Summary

semantic-ui-react (v2.1.5) depends on [email protected], which is affected by CVE-2026-4800. This introduces a potential security risk via a transitive dependency.

Details

• Package: semantic-ui-react
• Version: 2.1.5
• Vulnerable dependency: [email protected]
• CVE: https://nvd.nist.gov/vuln/detail/CVE-2026-4800

The vulnerability is related to unsafe object handling (prototype pollution), which may allow:

• Injection of unexpected properties into objects
• Manipulation of application logic
• Potential denial of service (DoS) or other unintended behavior depending on usage

Even if not directly exploitable within semantic-ui-react, this dependency may expose downstream applications to risk.

Reproduction

npm install [email protected]
npm ls lodash-es

Expected

Dependency should resolve to a patched/non-vulnerable version of lodash-es.