CVE-2018-3721 Prototype Pollution in lodash
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2018-3721?
CVE-2018-3721 is a medium-severity vulnerability in Netapp Active Iq Unified Manager, published on 7 Jun 2018.
Official description
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Which versions are affected by CVE-2018-3721?
4 open source packages ship an affected version, including lodash-rails and lodash. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
lodash-rails RubyGems | All versions | 4.17.5 |
lodash-rails RubyGems | All versions | 4.17.5 |
lodash npm | All versions | 4.17.5 |
lodash npm | All versions | 4.17.5 |
Products include Lodash Lodash, Netapp Active Iq Unified Manager, Netapp System Manager.
How do I fix CVE-2018-3721?
Upgrade lodash-rails to 4.17.5 or later.
Is CVE-2018-3721 being exploited?
There is no known exploitation of CVE-2018-3721 in the wild and no public exploit code.
Other vulnerabilities in Netapp Active Iq Unified Manager
- CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names
- CVE-2020-8203 Prototype Pollution in lodash
- CVE-2021-23337 Command Injection
- CVE-2025-13465 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
- CVE-2026-2950 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Sources
Also known as AZL-45420, CLSA-2026-1784250516, DEBIAN-CVE-2018-3721, GHSA-fvqr-27wr-82fm, MINI-37hp-76jx-fhmg, MINI-rmc3-rxj3-xc2r and 1 more.