PT-2020-5991

Name of the Vulnerable Software and Affected Versions Lodash versions prior to 4.17.20 Lodash versions prior to 4.17.19 Description The issue is related to a prototype pollution attack when using the .zipObjectDeep function in Lodash. This can lead to denial of service or code execution under...

Prototype Pollution

Overview lodash-rails is a lodash for the Rails asset pipeline. Affected versions of this package are vulnerable to Prototype Pollution. The function zipObjectDeep can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects. PoC js...