CVE-2018-16487

2019-02-0118:29:00

Google

osv.dev

6.6 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

47.9%

JSON

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

CPENameOperatorVersion
lodasheq3.9.1-npm
lodasheq4.13.1-npm
lodasheq4.6.0-npm
lodasheq4.2.0-npm
lodasheq4.8.2-npm
lodasheq4.14.2-npm
lodasheq3.9.2-npm
lodasheq4.0.1-npm
lodasheq4.11.1-npm
lodasheq3.9.3-npm

Name	Operator	Version
lodash	eq	3.9.1-npm
lodash	eq	4.13.1-npm
lodash	eq	4.6.0-npm
lodash	eq	4.2.0-npm
lodash	eq	4.8.2-npm
lodash	eq	4.14.2-npm
lodash	eq	3.9.2-npm
lodash	eq	4.0.1-npm
lodash	eq	4.11.1-npm
lodash	eq	3.9.3-npm