GHSA-h5mp-5q4p-ggf5 Prototype Pollution in lodash.defaultsdeep
Prototype pollution in lodash.defaultsdeep allows attackers to modify Object prototypes, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-h5mp-5q4p-ggf5?
GHSA-h5mp-5q4p-ggf5 is a vulnerability in lodash.defaultsdeep, published on 3 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of lodash.defaultsdeep before 4.6.1 are vulnerable to prototype pollution. The function mergeWith may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update to version 4.6.1 or later.
Which versions are affected by GHSA-h5mp-5q4p-ggf5?
2 open source packages ship an affected version, including lodash.defaultsdeep.
| Package | Affected | Fixed in |
|---|---|---|
lodash.defaultsdeep npm | All versions | 4.6.1 |
lodash.defaultsdeep npm | All versions | 4.6.1 |
How do I fix GHSA-h5mp-5q4p-ggf5?
Upgrade lodash.defaultsdeep to 4.6.1 or later.
Is GHSA-h5mp-5q4p-ggf5 being exploited?
There is no known exploitation of GHSA-h5mp-5q4p-ggf5 in the wild and no public exploit code.