.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

Vulnerability advisory

GHSA-jf85-cpcp-j695

Prototype Pollution in lodash

Published Jul 10, 2019Updated Sep 10, 2026OSV record ↗

Also known as CVE-2019-10744SNYK-JS-LODASH-450202

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected versions

lodash npm

All lodash advisories →

Affected	Fixed in
All versions before 4.17.12	`4.17.12`Advisories →

lodash-es npm

All lodash-es advisories →

Affected	Fixed in
All versions before 4.17.14	`4.17.14`Advisories →

lodash-amd npm

All lodash-amd advisories →

Affected	Fixed in
All versions before 4.17.13	`4.17.13`Advisories →

lodash.defaultsdeep npm

All lodash.defaultsdeep advisories →

Affected	Fixed in
All versions before 4.6.1	`4.6.1`Advisories →

lodash-rails RubyGems

All lodash-rails advisories →

Affected Fixed in

All versions before 4.17.12 4.17.12Advisories →

Also listed as affected (53)

Description

Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.

Recommendation

Update to version 4.17.12 or later.

References