lodash.merge before 4.6.2 is vulnerable to prototype pollution. The function merge() may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
WS-2019-0185 - High Severity Vulnerability
The Lodash method `_.merge` exported as a module.
Library home page: https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.1.tgz
Path to dependency file: batimagen/package.json
Path to vulnerable library: batimagen/node_modules/lodash.merge/package.json
Dependency Hierarchy: - vision-0.25.0.tgz (Root Library) - :x: **lodash.merge-4.6.1.tgz** (Vulnerable Library)
Found in HEAD commit: c0a367c5b1397d97c121bb83f39950920f054dca
lodash.merge before 4.6.2 is vulnerable to prototype pollution. The function merge() may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Publish Date: 2019-08-14
URL: WS-2019-0185
Base Score Metrics: - Exploitability Metrics: - Attack Vector: N/A - Attack Complexity: N/A - Privileges Required: N/A - User Interaction: N/A - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1066
Release Date: 2019-08-14
Fix Resolution: 4.6.2
Step up your Open Source Security Game with WhiteSource here