EIQ-2019-0016

EIQ-2019-0016

CVE-2018-3721

lodash enables prototype pollution

22 Mar 2019

2 - MEDIUM

6.5

2.4.0

The lodash Node.js module versions 4.17.4 and earlier make it possible for an attacker to exploit a Modification of Assumed-Immutable Data (MAID) vulnerability through the defaultsDeep, merge, and mergeWith functions.
In this way, an attacker could add or modify object prototype properties via the __proto__ accessor property.
Modified properties are propagated through inheritance to all objects.

Update to lodash 4.17.11 or later.

2.3.4 and earlier.

For more information, see:

• CVE-2018-3721, Mitre report

• CVE-2018-3721, HackerOne report

• GitHub commit with the fix