PT-2018-3812 · Lodash · Lodash
Published
2018-10-30
·
Updated
2026-05-29
·
CVE-2018-16487
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
lodash versions prior to 4.17.11
Description
A prototype pollution issue was discovered in the
merge, mergeWith, and defaultsDeep functions of the lodash library. This issue can be exploited to add or modify properties of Object.prototype. The vulnerability can be triggered by a malicious user using {constructor: {prototype: {...}}} to modify the prototype of Object, resulting in the addition or modification of an existing property that will exist on all objects. The exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.Recommendations
Update to version 4.17.11 or later.
As a temporary workaround, consider avoiding the use of the
merge, mergeWith, and defaultsDeep functions until a patch is available.Exploit
Fix
Prototype Pollution
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Lodash