All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Command Injection via template.