Vulnerability GHSA-xxjr-mmjv-4gpg

Medium Risk

8 months ago

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

4.0.0 - 4.17.21

Summary

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

Details

Impact

Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.

The issue permits deletion of properties but does not allow overwriting their original behavior.

Patches

This issue is patched on 4.17.23.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

High Risk

6 months ago

lodash vulnerable to Code Injection via `_.template` imports key names

4.0.0 - 4.17.23 GHSA-r5fr-rjxr-66jc

High Risk

6 months ago

lodash vulnerable to Code Injection via `_.template` imports key names

4.0.0 - 4.17.23 GHSA-r5fr-rjxr-66jc

High Risk

6 months ago

lodash vulnerable to Code Injection via `_.template` imports key names

4.0.0 - 4.17.23 GHSA-r5fr-rjxr-66jc

Medium Risk

6 months ago

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

2.0.0 - 4.17.23 GHSA-f23m-r3pf-42rh

Medium Risk

6 months ago

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

2.0.0 - 4.17.23 GHSA-f23m-r3pf-42rh

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

8 months ago

Fixed (4.17.23)

8 months ago

Fixed (4.17.23)

8 months ago

Fixed (4.17.23)

8 months ago

Last Modified

16 hours ago