Impact: The fix for CVE-2021-23337

#!/usr/bin/env python3
# CVE-2026-4800 verifier for Lodash packages
# Usage: python3 check_cve_2026_4800.py /path/to/app
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

import json
import os
import re
import sys
from typing import Optional, Tuple, List

TARGETS = {
    'lodash': (4, 18, 0),
    'lodash-es': (4, 18, 0),
    'lodash-amd': (4, 18, 0),
    'lodash.template': (4, 18, 0),
}

Version = Tuple[int, int, int]


def parse_version(raw: str) -> Optional[Version]:
    if not raw:
        return None
    m = re.search(r'(\d+)\.(\d+)\.(\d+)', raw)
    if not m:
        return None
    return (int(m.group(1)), int(m.group(2)), int(m.group(3)))


def is_vulnerable(pkg: str, ver: Version) -> bool:
    fixed = TARGETS[pkg]
    return ver >= (4, 0, 0) and ver < fixed


def load_json(path: str):
    try:
        with open(path, 'r', encoding='utf-8') as f:
            return json.load(f)
    except Exception:
        return None


def check_node_modules(root: str) -> List[str]:
    findings = []
    nm = os.path.join(root, 'node_modules')
    if not os.path.isdir(nm):
        return findings
    for pkg in TARGETS:
        pkg_json = os.path.join(nm, pkg, 'package.json')
        data = load_json(pkg_json)
        if not data:
            continue
        ver = parse_version(str(data.get('version', '')))
        if not ver:
            findings.append(f'UNKNOWN {pkg} version unreadable in node_modules')
            continue
        if is_vulnerable(pkg, ver):
            findings.append(f'VULNERABLE {pkg} {data.get("version")} via node_modules')
        else:
            findings.append(f'PATCHED {pkg} {data.get("version")} via node_modules')
    return findings


def walk_pkg_lock_packages(packages_obj) -> List[str]:
    findings = []
    if not isinstance(packages_obj, dict):
        return findings
    for path_key, meta in packages_obj.items():
        if not isinstance(meta, dict):
            continue
        name = meta.get('name')
        if not name and path_key.startswith('node_modules/'):
            name = path_key.split('node_modules/', 1)[1]
        if name not in TARGETS:
            continue
        ver = parse_version(str(meta.get('version', '')))
        if not ver:
            findings.append(f'UNKNOWN {name} version unreadable in package-lock packages')
            continue
        if is_vulnerable(name, ver):
            findings.append(f'VULNERABLE {name} {meta.get("version")} via package-lock packages')
        else:
            findings.append(f'PATCHED {name} {meta.get("version")} via package-lock packages')
    return findings


def walk_dependency_tree(deps) -> List[str]:
    findings = []
    if not isinstance(deps, dict):
        return findings
    stack = list(deps.items())
    while stack:
        name, meta = stack.pop()
        if not isinstance(meta, dict):
            continue
        if name in TARGETS:
            ver = parse_version(str(meta.get('version', '')))
            if not ver:
                findings.append(f'UNKNOWN {name} version unreadable in dependency tree')
            elif is_vulnerable(name, ver):
                findings.append(f'VULNERABLE {name} {meta.get("version")} via dependency tree')
            else:
                findings.append(f'PATCHED {name} {meta.get("version")} via dependency tree')
        child = meta.get('dependencies')
        if isinstance(child, dict):
            stack.extend(child.items())
    return findings


def check_package_lock(root: str) -> List[str]:
    findings = []
    for filename in ('package-lock.json', 'npm-shrinkwrap.json'):
        path = os.path.join(root, filename)
        data = load_json(path)
        if not data:
            continue
        findings.extend(walk_pkg_lock_packages(data.get('packages')))
        findings.extend(walk_dependency_tree(data.get('dependencies')))
    return findings


def dedupe(findings: List[str]) -> List[str]:
    seen = set()
    out = []
    for item in findings:
        if item not in seen:
            seen.add(item)
            out.append(item)
    return out


def main() -> int:
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_cve_2026_4800.py /path/to/app')
        return 2

    root = sys.argv[1]
    if not os.path.isdir(root):
        print(f'UNKNOWN - path not found: {root}')
        return 2

    findings = []
    findings.extend(check_node_modules(root))
    findings.extend(check_package_lock(root))
    findings = dedupe(findings)

    if not findings:
        print('UNKNOWN - no target packages found in node_modules or npm lockfiles')
        return 2

    vuln = [f for f in findings if f.startswith('VULNERABLE ')]
    patched = [f for f in findings if f.startswith('PATCHED ')]

    if vuln:
        print('VULNERABLE - ' + '; '.join(vuln))
        return 1
    if patched:
        print('PATCHED - ' + '; '.join(patched))
        return 0

    print('UNKNOWN - ' + '; '.join(findings))
    return 2


if __name__ == '__main__':
    sys.exit(main())