Packages / lodash / Security

ModerateVulnerabilityGHSA-fvqr-27wr-82fmCVE-2018-3721Published 26 Jul 2018

Prototype Pollution in lodash

Your version

Affected releases · lodash

  • 4.x4.0.0 – 4.17.4Fixed in 4.17.5
  • 3.x and older0.1.0 – 3.10.1No fix, no longer updated

On 4.x, the newest line:

npm install lodash@4.17.5
Every release on a timeline
4.x

  1. Affected

    4.0.0 – 4.17.4

    39 releases

  2. Fixed

    4.17.5 – 4.18.1

    17 releases, latest

3.x

  1. Affected

    3.0.0 – 3.10.1

    17 releases

2.x

  1. Affected

    2.0.0 – 2.4.2

    8 releases

1.x

  1. Affected

    1.0.0 – 1.3.1

    9 releases

0.x

  1. Affected

    0.1.0 – 0.10.0

    23 releases

113 stable releases of lodash, oldest to newest, one row per major.

What happens

Versions of lodash before 4.17.5 are vulnerable to prototype pollution.

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.

Recommendation

Update to version 4.17.5 or later.