# CVE-2018-3721: lodash prototype pollution in merge functions

Source: https://junglewise.ai/threats/cve-2018-3721-lodash-prototype-pollution-in-merge-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2018-3721 · Severity: low · CVSS 3.1 · Published 2018-07-26

Lodash is a widely-used JavaScript utility library that provides functions for working with objects and arrays. Versions before 4.17.5 contain a prototype pollution vulnerability in the merge, mergeWith, and defaultsDeep functions, allowing an attacker with access to these functions to inject malicious properties into all JavaScript objects in an application, potentially compromising data integrity and enabling privilege escalation.

Technologies: [lodash (npm)](https://junglewise.ai/threats/technologies/lodash), [lodash-rails (RubyGems)](https://junglewise.ai/threats/technologies/lodash-rails). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2018-3721 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2018-3721 being exploited in the wild.

**How severe is CVE-2018-3721?** Low severity, with a CVSS score of 3.1, published 26 July 2018.

**Which products and versions are affected?** lodash (npm) SEMVER:introduced=0,fixed=4.17.5; lodash-rails (RubyGems) ECOSYSTEM:introduced=0,fixed=4.17.5.

**Is there a fix for CVE-2018-3721?** Yes. lodash (npm): upgrade to 4.17.5 or later; lodash-rails (RubyGems): upgrade to 4.17.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2018-3721 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2018-3721?** Check whether you run lodash (npm) or lodash-rails (RubyGems) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lodash (npm): upgrade to 4.17.5 or later

  ```sh
  npm install lodash@4.17.5
  ```

- lodash-rails (RubyGems): upgrade to 4.17.5 or later

  ```sh
  bundle update lodash-rails
  ```


## Technical details

This is a prototype pollution vulnerability in lodash's merge-related functions (merge, mergeWith, and defaultsDeep). The vulnerable code fails to sanitize the __proto__ property when merging objects, allowing an attacker to modify the Object prototype chain. The vulnerability requires the attacker to have control over input passed to these vulnerable functions (typically via network requests or application inputs). By injecting a malicious __proto__ property into merge payloads, an attacker can add or modify properties on the prototype that will exist on all subsequent object instances, potentially leading to authentication bypass, property injection, or other logic manipulation. The fix, released in version 4.17.5, explicitly avoids merging properties onto __proto__ objects.

## Affected products

- lodash lodash before 4.17.5
- lodash-rails lodash-rails before 4.17.5

## Identifiers

- CVE-2018-3721
- GHSA-fvqr-27wr-82fm

## Timeline

- 2018-06-07: disclosed: NVD published
- 2018-07-26: advisory: GHSA advisory published
- 2018: patched: Fixed in version 4.17.5

## References

- [https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a](https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a)

## Related threats

- [lodash vulnerable to Code Injection via `_.template` imports key names](https://junglewise.ai/threats/cve-2021-23337-lodash-command-injection-in-template-function)
- [Lodash prototype pollution in unset and omit functions](https://junglewise.ai/threats/cve-2026-2950-lodash-prototype-pollution-in-unset-and-omit-functions)
- [Lodash prototype pollution in _.unset and _.omit functions](https://junglewise.ai/threats/cve-2025-13465-lodash-prototype-pollution-in-unset-and-omit-functions)
- [lodash ReDoS in toNumber and trim functions](https://junglewise.ai/threats/cve-2020-28500-lodash-redos-in-tonumber-and-trim-functions)
- [lodash prototype pollution in property mutation functions](https://junglewise.ai/threats/cve-2020-8203-lodash-prototype-pollution-in-property-mutation-functions)