Description
Versions of lodash.defaultsdeep before 4.6.1 are vulnerable to prototype pollution. The function mergeWith may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Recommendation
Update the lodash.defaultsdeep package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.6.1
- Patched version(s): 4.6.1
References
Related Issues
- Astro allows unauthorized third-party images in _image endpoint - CVE-2025-55303
- Joplin Cross-site Scripting vulnerability (GHSA-7grw-xfx6-qhx6) - CVE-2023-37298
- rgb2hex vulnerable to inefficient regular expression complexity - CVE-2018-25061
- jQuery-UI vulnerable to Cross-site Scripting in dialog closeText - CVE-2016-7103
- Tags:
- npm
- lodash.defaultsdeep
Anything's wrong? Let us know Last updated on January 09, 2023