GitHub Advisoryadvisory · npm, RubyGems

GHSA-jf85-cpcp-j695 Prototype Pollution in lodash

CRITICAL Published 2019-07-10 Modified 2025-08-12 Official page ↗
Aliases
CVE-2019-10744
Ecosystem
npm, RubyGems
Packages
lodash, lodash-es, lodash-amd, lodash.defaultsdeep, lodash-rails
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-1321, CWE-20
Reviewed
2019-07-10

Affected packages

• npm lodash: < 4.17.12 → fixed in 4.17.12 • npm lodash-es: < 4.17.14 → fixed in 4.17.14 • npm lodash-amd: < 4.17.13 → fixed in 4.17.13 • npm lodash.defaultsdeep: < 4.6.1 → fixed in 4.6.1 • RubyGems lodash-rails: < 4.17.12 → fixed in 4.17.12

Description

Versions of `lodash` before 4.17.12 are vulnerable to Prototype Pollution. The function `defaultsDeep` allows a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects. Recommendation Update to version 4.17.12 or later.

Related

Alias · CVE (1)

  • CVE-2019-10744 Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-20 Improper Input Validation weakness

References