Prototype Pollution In node-lodash
Description
Prototype Pollution in lodash
Versions of lodash before 4.17.5 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.5 or later.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 12 | 4.17.11+dfsg-1 | ||
debian 14 | 4.17.11+dfsg-1 | ||
debian 13 | 4.17.11+dfsg-1 | ||
 npm | 4.17.5 | ||
 rubygems | 4.17.5 | ||
debian 11 | 4.17.11+dfsg-1 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4.