Packages / lodash / Security

CriticalVulnerabilityGHSA-jf85-cpcp-j695CVE-2019-10744SNYK-JS-LODASH-450202Published 10 Jul 2019

Prototype Pollution in lodash

Your version

Affected releases · lodash

  • 4.x4.0.0 – 4.17.11Fixed in 4.17.12
  • 3.x and older0.1.0 – 3.10.1No fix, no longer updated

On 4.x, the newest line:

npm install lodash@4.17.12
Every release on a timeline
4.x

  1. Affected

    4.0.0 – 4.17.11

    43 releases

  2. Fixed

    4.17.12 – 4.18.1

    13 releases, latest

3.x

  1. Affected

    3.0.0 – 3.10.1

    17 releases

2.x

  1. Affected

    2.0.0 – 2.4.2

    8 releases

1.x

  1. Affected

    1.0.0 – 1.3.1

    9 releases

0.x

  1. Affected

    0.1.0 – 0.10.0

    23 releases

113 stable releases of lodash, oldest to newest, one row per major.

What happens

Versions of lodash before 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep allows a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.

Recommendation

Update to version 4.17.12 or later.