Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 4.17.5 | 4.17.5Advisories → |
| Affected | Fixed in |
|---|---|
| All versions before 4.17.5 | 4.17.5Advisories → |
Also listed as affected (50) | |
Description
Versions of lodash before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.5 or later.