GitHub Advisoryadvisory · npm, RubyGems

GHSA-fvqr-27wr-82fm Prototype Pollution in lodash

MEDIUM Published 2018-07-26 Modified 2025-08-12 Official page ↗
Aliases
CVE-2018-3721
Ecosystem
npm, RubyGems
Packages
lodash, lodash-rails
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1321, CWE-471
Reviewed
2020-06-16

Affected packages

• npm lodash: < 4.17.5 → fixed in 4.17.5 • RubyGems lodash-rails: < 4.17.5 → fixed in 4.17.5

Description

Versions of `lodash` before 4.17.5 are vulnerable to prototype pollution. The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects. Recommendation Update to version 4.17.5 or later.

Related

Alias · CVE (1)

  • CVE-2018-3721 lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and… vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-471 Modification of Assumed-Immutable Data (MAID) weakness

References