CVE-2018-3721: hackerone lodash node module
Vulnerability summary
CVE-2018-3721 is a medium (CVSS 6.5) vulnerability in hackerone lodash node module. EPSS estimates a 2.35% chance of exploitation in the next 30 days, higher than 83.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 07-06-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · NpmEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · RubygemsEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
2.35%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
-0.04 pp
From 2.38% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-471Modification of Assumed-Immutable Data (MAID)The product does not properly protect an assumed-immutable element from being modified by an attacker.
- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Affected systems
Netapp2 products
Debian1 product
- node-lodash< 4.17.11+dfsg-1
Hackerone1 product
- lodash node moduleVersions before 4.17.5
Lodash1 product
- lodash< 4.17.5
Npm1 product
- lodash< 4.17.5
RubyGems1 product
- lodash-rails< 4.17.5
Ubuntu1 product
- node-lodashAll versions (No fix recorded)
7 vendors · 8 products
References
11 links- github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4aX Refsource MISCPatchREPORTWEB
