PT-2019-2936 · Lodash · Lodash

Published 2019-07-04 · Updated 2026-04-14 · CVE-2019-10744

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions lodash versions prior to 4.17.12

Description The issue is related to the defaultsDeep function in the lodash library, which can be tricked into adding or modifying properties of Object.prototype using a constructor payload. This is due to insufficient input validation, allowing a remote attacker to cause a denial of service, execute arbitrary JavaScript code, or elevate their privileges. The vulnerability can be exploited by a malicious user modifying the prototype of Object via {constructor: {prototype: {...}}}, causing the addition or modification of an existing property that will exist on all objects.

Recommendations Update to version 4.17.12 or later. As a temporary workaround, consider restricting the use of the defaultsDeep function until a patch is available. Avoid using the constructor property in the affected defaultsDeep function to minimize the risk of exploitation.

Exploit

Fix

Prototype Pollution

RCE

Weakness Enumeration

CWE-1321

CWE-20

Related Identifiers

AZL-44634

BDU:2019-02911

CVE-2019-10744

GHSA-JF85-CPCP-J695

RHSA-2019:3024

RHSA-2020:2362

SNYK-JS-LODASH-450202

Affected Products

Lodash

References · 28

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-10744.yml · Exploit
• 🔥 https://snyk.io/vuln/SNYK-JS-LODASH-450202 · Exploit
• https://osv.dev/vulnerability/CVE-2019-10744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10744 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2019-10744 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-10744 · Security Note
• https://oracle.com/security-alerts/cpuoct2020.html · Patch
• https://access.redhat.com/errata/RHSA-2019:3024 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-10744 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-10744 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-10744 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jf85-cpcp-j695 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44634 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-10744 · Vendor Advisory
• https://oracle.com/security-alerts/cpujan2021.html · Patch