HighGHSA-h5mp-5q4p-ggf5
Prototype Pollution in lodash.defaultsdeep
Published 3 Sept 2020 · Updated 31 Aug 2020
Affected package
- Affected
- <4.6.1
- Fixed in
- 4.6.1
Update to the fixed version for your release line, for example:
npm install lodash.defaultsdeep@4.6.1Details
Versions of lodash.defaultsdeep before 4.6.1 are vulnerable to prototype pollution. The function mergeWith may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.6.1 or later.
Is GHSA-h5mp-5q4p-ggf5 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected lodash.defaultsdeep, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.