Prototype Pollution In lodash-rails
Description
Prototype Pollution in lodash
Versions of lodash before 4.17.11 are vulnerable to prototype pollution.
The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.17.11 or later.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 rubygems | 4.17.11 | ||
 npm | 4.17.11 | ||
 debian 11 | 4.17.11+dfsg-1 | ||
debian 12 | 4.17.11+dfsg-1 | ||
debian 14 | 4.17.11+dfsg-1 | ||
debian 13 | 4.17.11+dfsg-1 |
Aliases
1. 2. 3. 4. 5. 6.
References
1. 2. 3. 4.