Executive brief
lodash.mergewith is a JavaScript utility library function used to merge objects in web applications. A vulnerability allows an attacker to inject malicious properties into all objects in an application through prototype pollution, potentially compromising data integrity and enabling unauthorized access or behavior modification across the affected system.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in the mergeWith function that fails to properly sanitize the __proto__ property during object merge operations. An attacker can supply a crafted object containing __proto__ as a key, which causes the function to modify the Object prototype itself rather than a regular property. This affects all objects in the application, potentially leading to property injection, authentication bypass, or code execution depending on how the application uses object properties. The vulnerability exists in all versions prior to 4.6.1, which fixed the issue. No authentication or user interaction is required; an attacker simply needs to control input passed to mergeWith.
Affected products
- npm lodash.mergewith before 4.6.1
Timeline
- 2020-09-03: disclosed