CVE-2018-16487 Prototype Pollution in lodash
Prototype pollution in lodash allows attackers to modify Object.prototype, potentially leading to code execution or privilege escalation in applications using the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16487?
CVE-2018-16487 is a medium-severity vulnerability in HackerOne lodash, published on 1 Feb 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
Weakness: CWE-400
Which versions are affected by CVE-2018-16487?
4 open source packages ship an affected version, including lodash-rails and lodash. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
lodash-rails RubyGems | All versions | 4.17.11 |
lodash-rails RubyGems | All versions | 4.17.11 |
lodash npm | All versions | 4.17.11 |
lodash npm | All versions | 4.17.11 |
Products include Lodash Lodash.
How do I fix CVE-2018-16487?
Upgrade lodash-rails to 4.17.11 or later.
Is CVE-2018-16487 being exploited?
There is no known exploitation of CVE-2018-16487 in the wild and no public exploit code.
Other vulnerabilities in HackerOne lodash
- CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names
- CVE-2020-8203 Prototype Pollution in lodash
- CVE-2021-23337 Command Injection
- CVE-2025-13465 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
- CVE-2026-2950 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Sources
Also known as DEBIAN-CVE-2018-16487, GHSA-4xc9-xhrj-v574, MINI-86gc-qrf2-3cc4, MINI-c2v2-m3rm-4xqq, ROOT-APP-NPM-CVE-2018-16487, UBUNTU-CVE-2018-16487.