CVE-2018-16487

MEDIUM

lodash < 4.17.11 - Prototype Pollution via merge, mergeWith, and defaultsDeep Functions

Title source: llm

Description

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

References (2)

Core 2

Core References

Exploit, Issue Tracking, Third Party Advisory x_refsource_misc

https://hackerone.com/reports/380873

Third Party Advisory x_refsource_confirm

https://security.netapp.com/advisory/ntap-20190919-0004/

Scores

CVSS v3 5.6

EPSS 0.0051

EPSS Percentile 66.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Details

CWE

CWE-400

Status published

Products (3)

lodash/lodash < 4.17.11

npm/lodash 0 - 4.17.11npm

rubygems/lodash-rails 0 - 4.17.11RubyGems

Published Feb 01, 2019

Tracked Since Feb 18, 2026