Prototype Pollution Vulnerability in node-lodash
Summary
CVE-2018-16487: A prototype pollution vulnerability was found in lodash. Affects node-lodash across 2 version ranges.
< 3e273e915d1c4176a987fa6ad65e849f59d60453
< 4.17.11+dfsg-1
Fixed in 4.17.11+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
node-lodash is a package in the Debian ecosystem that provides a set of utility functions for manipulating objects and arrays in JavaScript. It is widely used in Node.js applications for its convenience and efficiency. However, a vulnerability known as Prototype Pollution has been discovered in versions prior to 4.17.11+dfsg-1. This vulnerability allows an attacker to modify or add properties to the Object.prototype using the merge, mergeWith, and defaultsDeep functions.
Vulnerability Detail
The Prototype Pollution vulnerability in node-lodash arises from a lack of proper input validation. By crafting malicious input, an attacker can manipulate the prototype chain of objects, leading to unexpected behavior and potential security issues. This could result in the modification of critical properties or the execution of arbitrary code. The impact of this vulnerability depends on how the affected functions are used within the application.
How To Fix
Minimum fixed version
4.17.11+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-lodashTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the patched version is not immediately feasible, a temporary workaround is to implement input validation and sanitization when using the merge, mergeWith, and defaultsDeep functions. Ensure that only trusted and properly validated data is passed as input to these functions.
Conclusion
The Prototype Pollution vulnerability in node-lodash can have serious security implications if left unpatched. It is crucial to upgrade to the latest version or implement the recommended workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-lodash →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify or add properties to the prototype of an object. This can lead to unexpected behavior and potential security issues.
The merge, mergeWith, and defaultsDeep functions in node-lodash are affected by this vulnerability.
The impact of this vulnerability depends on how the affected functions are used within the application. It could result in the modification of critical properties or the execution of arbitrary code.
To fix this vulnerability, upgrade node-lodash to version 4.17.11+dfsg-1 or later. Implement input validation and sanitization when using the affected functions as a temporary workaround.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground and it will provide real-time alerts for open-source vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for node-lodash.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
