You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
❌ lodash-1.0.0.tgz (Vulnerable Library)
Found in base branch: main
Vulnerability Details
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
mend-for-github-combot
changed the title
CVE-2019-10744 (High) detected in lodash-1.0.0.tgz
CVE-2019-10744 (Critical) detected in lodash-1.0.0.tgz
Dec 17, 2023
CVE-2019-10744 - Critical Severity Vulnerability
A utility library delivering consistency, customization, performance, and extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in base branch: main
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-25
URL: CVE-2019-10744
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-jf85-cpcp-j695
Release Date: 2019-07-25
Fix Resolution: 4.17.12
The text was updated successfully, but these errors were encountered: