Executive brief
lodash.merge is a widely-used JavaScript utility library for merging objects. Versions prior to 4.6.2 are vulnerable to prototype pollution, which allows attackers to modify the prototype chain of JavaScript objects. This can result in unexpected behavior across an application, potentially leading to security bypasses, privilege escalation, or denial of service.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) in the merge function of lodash.merge. An attacker can supply a malicious input object containing a constructor.prototype property that modifies the Object prototype, injecting or overwriting properties on all objects in the application. The attack requires calling the merge function with an untrusted input object, typically from user-supplied data in web applications. No authentication or special privileges are required to exploit this vulnerability. Affected versions are all releases before 4.6.2; users should upgrade to 4.6.2 or later.
Affected products
- lodash lodash.merge < 4.6.2
Timeline
- 2020-09-03: disclosed