Is CVE-2018-16487 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-16487 being exploited in the wild.

How severe is CVE-2018-16487?

Informational severity, with a CVSS score of 7.5, published 7 February 2019.

Which products and versions are affected?

lodash (npm) SEMVER:introduced=0,fixed=4.17.11; lodash-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=4.17.11.

Is there a fix for CVE-2018-16487?

Yes. lodash (npm): upgrade to 4.17.11 or later; lodash-rails (RubyGems): upgrade to 4.17.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-16487 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-16487?

Check whether you run lodash (npm) or lodash-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-16487: lodash prototype pollution in merge functions

CVE-2018-16487 · Severity: info · CVSS 7.5 · Published 2019-02-07

lodash is a widely-used JavaScript library that provides utility functions for common programming tasks. Versions before 4.17.11 contain a prototype pollution vulnerability in the merge and mergeWith functions that allows an attacker to add or modify properties on all JavaScript objects application-wide. This can lead to application logic bypass, data manipulation, or unauthorized behavior depending on how the application uses these properties.

Technologies: lodash (npm), lodash-rails (RubyGems). Vendors: npm, RubyGems.

Quick answers

Is CVE-2018-16487 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-16487 being exploited in the wild.
How severe is CVE-2018-16487?: Informational severity, with a CVSS score of 7.5, published 7 February 2019.
Which products and versions are affected?: lodash (npm) SEMVER:introduced=0,fixed=4.17.11; lodash-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=4.17.11.
Is there a fix for CVE-2018-16487?: Yes. lodash (npm): upgrade to 4.17.11 or later; lodash-rails (RubyGems): upgrade to 4.17.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-16487 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-16487?: Check whether you run lodash (npm) or lodash-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lodash (npm): upgrade to 4.17.11 or later
```
npm install lodash@4.17.11
```
lodash-rails (RubyGems): upgrade to 4.17.11 or later
```
bundle update lodash-rails
```

Technical details

The vulnerability is a prototype pollution (CWE-400) affecting lodash functions defaultsDeep, merge, and mergeWith in versions before 4.17.11. An attacker can craft a malicious object with a constructor.prototype path that, when passed to these merge functions, modifies Object.prototype itself. No authentication or special network access is required—any code that calls these functions with untrusted input is at risk. The attack allows adding or modifying arbitrary properties on all object instances globally, potentially leading to authorization bypasses, logic errors, or other application-level compromises. The fix was released in version 4.17.11 and is available as a patch in the lodash repository.

Affected products

lodash lodash before 4.17.11
lodash lodash-rails before 4.17.11

Identifiers

CVE-2018-16487
GHSA-4xc9-xhrj-v574

Timeline

2019-02-07: disclosed
2018: patched: Fixed in lodash 4.17.11

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.