Prototype Pollution In lodash.unset
Description
Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions
Impact
Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.
The issue permits deletion of properties but does not allow overwriting their original behavior.
Patches
This issue is patched on 4.17.23.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 npm | 4.17.23 | ||
npm | 4.18.0 | ||
npm | 4.17.23 | ||
npm | 4.17.23 | ||
 debian 11 | 4.17.21+dfsg+~cs8.31.173-1+deb11u1 | ||
debian 12 | - | ||
debian 13 | - | ||
debian 14 | 4.17.21+dfsg+~cs8.31.198.20210220-10 | ||
 rpm rhel10 | - | - | |
rpm rhel10 | - | - |
1-10 of 41
10
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4.