Packages / lodash / Security

HighVulnerabilityGHSA-4xc9-xhrj-v574CVE-2018-16487Published 7 Feb 2019

Prototype Pollution in lodash

Your version

Affected releases · lodash

  • 4.x4.0.0 – 4.17.10Fixed in 4.17.11
  • 3.x and older0.1.0 – 3.10.1No fix, no longer updated

On 4.x, the newest line:

npm install lodash@4.17.11
Every release on a timeline
4.x

  1. Affected

    4.0.0 – 4.17.10

    42 releases

  2. Fixed

    4.17.11 – 4.18.1

    14 releases, latest

3.x

  1. Affected

    3.0.0 – 3.10.1

    17 releases

2.x

  1. Affected

    2.0.0 – 2.4.2

    8 releases

1.x

  1. Affected

    1.0.0 – 1.3.1

    9 releases

0.x

  1. Affected

    0.1.0 – 0.10.0

    23 releases

113 stable releases of lodash, oldest to newest, one row per major.

What happens

Versions of lodash before 4.17.11 are vulnerable to prototype pollution.

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.

Recommendation

Update to version 4.17.11 or later.