Executive brief
lodash is a widely-used JavaScript library that provides utility functions for common programming tasks. Versions before 4.17.11 contain a prototype pollution vulnerability in the merge and mergeWith functions that allows an attacker to add or modify properties on all JavaScript objects application-wide. This can lead to application logic bypass, data manipulation, or unauthorized behavior depending on how the application uses these properties.
Technical details
The vulnerability is a prototype pollution (CWE-400) affecting lodash functions defaultsDeep, merge, and mergeWith in versions before 4.17.11. An attacker can craft a malicious object with a constructor.prototype path that, when passed to these merge functions, modifies Object.prototype itself. No authentication or special network access is required—any code that calls these functions with untrusted input is at risk. The attack allows adding or modifying arbitrary properties on all object instances globally, potentially leading to authorization bypasses, logic errors, or other application-level compromises. The fix was released in version 4.17.11 and is available as a patch in the lodash repository.
Affected products
- lodash lodash before 4.17.11
- lodash lodash-rails before 4.17.11
Timeline
- 2019-02-07: disclosed
- 2018: patched: Fixed in lodash 4.17.11