p PatchFirst

CVE-2019-10744

CVE-2019-10744

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

CVSS 9.1 · Critical · EPSS 5.0% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • lodash

    Versions
    • All versions prior to 4.17.12: Affected

    No fix published

  • node-lodash Debian:12

    Affected ranges
    • ECOSYSTEM: < 4.17.15+dfsg-1

    Update to 4.17.15+dfsg-1

  • node-lodash Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.17.15+dfsg-1

    Update to 4.17.15+dfsg-1

  • node-lodash Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.17.15+dfsg-1

    Update to 4.17.15+dfsg-1

  • lodash npm

    Affected ranges
    • SEMVER: < 4.17.12

    Update to 4.17.12

  • lodash-es npm

    Affected ranges
    • SEMVER: < 4.17.14

    Update to 4.17.14

  • lodash-amd npm

    Affected ranges
    • SEMVER: < 4.17.13

    Update to 4.17.13

  • lodash.defaultsdeep npm

    Affected ranges
    • SEMVER: < 4.6.1

    Update to 4.6.1

  • lodash-rails RubyGems

    Versions
    • 0.10.0
    • 0.7.0
    • 0.8.1
    • 0.8.2
    • 0.9.0
    • 0.9.1
    • 0.9.2
    • 1.0.0.rc.1
    • 1.0.0.rc.2
    • 1.0.0.rc.3
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 1.2.1
    • 1.3.1
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.4.0
    • 2.4.1
    • 3.1.0
    • 3.10.0
    • 3.10.1
    • 3.2.0
    • 3.3.0
    • 3.3.1
    • 3.3.1.1
    • 3.4.0
    • 3.5.0
    • 3.6.0
    • 3.7.0
    • 3.9.3
    • 4.0.0
    • 4.11.2
    • 4.12.0
    • 4.13.1
    • 4.14.1
    • 4.15.0
    • 4.16.1
    • 4.16.3
    • 4.16.4
    • 4.16.6
    • 4.17.10
    • 4.17.11
    • 4.17.2
    • 4.17.4
    • 4.17.5
    • 4.3.0
    • 4.5.1
    • 4.6.1
    Affected ranges
    • ECOSYSTEM: < 4.17.12

    Update to 4.17.12

Original sources

Check your server →