Executive brief
Lodash.merge is a widely used utility library for combining data objects in JavaScript applications. A flaw in this library allows an attacker to inject unauthorized properties into the base object structure of the application. This can lead to unexpected behavior, application crashes, or potentially bypass security checks across the entire software environment.
Technical details
The 'merge' function in lodash.merge versions prior to 4.6.1 is vulnerable to Prototype Pollution (CWE-1321). By passing a specially crafted object containing the '__proto__' property, an attacker can inject or modify properties on the global Object prototype. This occurs because the function does not properly validate or sanitize keys during the recursive merge process. Successful exploitation can lead to denial of service or remote code execution depending on how the application utilizes the polluted objects. Users should update to version 4.6.1 or later to resolve this issue.
Affected products
- lodash lodash.merge < 4.6.1
Timeline
- 2020-08-31: patched: Fix released in version 4.6.1
- 2020-09-03: disclosed