Unpatched Prototype Pollution Flaw Affects All Versions of Popular Lodash Library

Lodash, a popular npm library used by more than 4 million projects on GitHub alone, is affected by a high severity security vulnerability that could allow attackers to compromise the security of affected services using the library and their respective user base. Lodash is a JavaScript library tha...

Unpatched Prototype Pollution Flaw Affects All Versions of Popular Lodash Library

Lodash, a popular npm library used by more than 4 million projects on GitHub alone, is affected by a high severity security vulnerability that could allow attackers to compromise the security of affected services using the library and their respective user base. Lodash is a JavaScript library tha...

Prototype Pollution

lodash is vulnerable to prototype pollution. The vulnerability exists due to the ability to inject properties in .defaultsDeep, which allows DoS, and possibly other forms of attacks...

10by10-react-app (1.2.1), 1508-cli (>=1.0.0, <=1.0.6) +13128 more potentially affected by CVE-2019-10744 via lodash (>=4.0.0, <=4.17.11)

lodash NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =0.0.2, =0.1.1, =1.0.0, =0.2.0, =0.1.0, =0.1.0, =0.0.1, =0.2.1, =0.0.2, =0.0.4 - 9wares-react 0.0.2 - @0x663/readclass 1.1.0 and more Source cves: CVE-2019-10744 Source advisory: SNYK:JS-LODASH-450202...

@maxts/waterline-adapter-tests (1.0.3), driver-interface (1.0.2) +9 more potentially affected by CVE-2019-10744 via @sailshq/lodash (3.10.2)

@sailshq/lodash NPM version 3.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on @sailshq/lodash and may be impacted: - @maxts/waterline-adapter-tests 1.0.3 - driver-interface 1.0.2 - machinepack-sockets =2.0.0, =5.2.0-0, =1.0.1, =0.9.1, =2.1.14,...

@admui/grid (>=0.1.10, <=0.3.1), @astro-my/design-systems (>=0.3.14, <=0.4.42) +157 more potentially affected by CVE-2019-10744 via lodash-es (>=4.0.0, <=4.17.11)

lodash-es NPM version =4.0.0, =0.1.10, =0.3.14, =0.4.63, =0.1.1, =0.1.1, =0.3.2-a, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.5.24 and more Source cves: CVE-2019-10744 Source advisory: SNYK:JS-LODASHES-2434290...

Prototype Pollution

Overview @sailshq/lodash is a fork of Lodash 3.10.x with ongoing maintenance from the Sails core team. Affected versions of this package are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. PoC by Snyk const mergeFn = require'lodash'.defaultsDeep; const payload = '"constructor...

Prototype Pollution

Overview lodash is an utility library delivering consistency, modularity, performance, & extras. Affected versions of this package are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload...

Prototype Pollution

Overview lodash is a modern JavaScript utility library delivering modularity, performance, & extras. Affected versions of this package are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor...

Prototype Pollution

Overview lodash-rails is a lodash for the Rails asset pipeline. Affected versions of this package are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload. PoC by Snyk const mergeFn =...

Discourse < 2.3.0.beta10 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities including vulnerabilities in 3rdparty components. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

@gkatsev/grunt-harp (>=0.18.0, <=0.19.0), @mobify/documentation-theme (>=1.11.3, <=2.0.0-preview.2-dev) +21 more potentially affected by CVE-2019-5438 via harp (>=0.9.5, <=0.32.0)

harp NPM version =0.9.5, =0.18.0, =1.11.3, =1.11.3, =0.0.3, =0.0.8-pre2, =0.0.1, =0.0.1, =0.0.1-1, =0.0.1, =0.1.0, =0.1.0, =0.2.9 - n-p-m 1.1.0 and more Source cves: CVE-2019-5438 Source advisory: OSV:GHSA-6FMM-47QC-P4M4...

Prototype Pollution

Overview Versions of lodash before 4.17.5 are vulnerable to prototype pollution. The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing...

1508-cli (>=1.0.0, <=1.0.6), 1k (>=0.0.1, <=0.0.11) +10667 more potentially affected by CVE-2018-16487 via lodash (>=4.0.0, <=4.17.10)

lodash NPM version =4.0.0, =1.0.0, =0.0.1, =0.0.2, =0.1.1, =1.0.0, =0.2.0, =0.1.0, =0.1.0, =0.0.1, =0.2.1, =0.0.2, =0.0.7, =0.4.20, =0.4.21 and more Source cves: CVE-2018-16487 Source advisory: OSV:GHSA-4XC9-XHRJ-V574...

Prototype Pollution in lodash

Versions of lodash before 4.17.11 are vulnerable to prototype pollution. The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing propert...

GHSA-4XC9-XHRJ-V574 Prototype Pollution in lodash

Versions of lodash before 4.17.11 are vulnerable to prototype pollution. The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing propert...

Prototype Pollution in lodash

Versions of lodash before 4.17.11 are vulnerable to prototype pollution. The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via constructor: prototype: ... causing the addition or modification of an existing propert...

CVE-2018-16487

A prototype pollution vulnerability was found in lodash 4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype...

CVE-2018-16487

A prototype pollution vulnerability was found in lodash 4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype...