You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the node_module "lodash" before version 4.17.11 the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.
WS-2018-0210 - Low Severity Vulnerability
Vulnerable Libraries - lodash-3.10.1.tgz, lodash-2.4.2.tgz, lodash-0.9.2.tgz
lodash-3.10.1.tgz
The modern build of lodash modular utilities.
path: /tmp/git/jenkins-material-theme/node_modules/applause/node_modules/lodash/package.json
Library home page: http://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz
Dependency Hierarchy:
lodash-2.4.2.tgz
A utility library delivering consistency, customization, performance, & extras.
path: /tmp/git/jenkins-material-theme/node_modules/findup-sync/node_modules/lodash/package.json
Library home page: http://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Dependency Hierarchy:
lodash-0.9.2.tgz
A utility library delivering consistency, customization, performance, and extras.
path: /tmp/git/jenkins-material-theme/node_modules/lodash/package.json
Library home page: http://registry.npmjs.org/lodash/-/lodash-0.9.2.tgz
Dependency Hierarchy:
Vulnerability Details
In the node_module "lodash" before version 4.17.11 the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.
Publish Date: 2018-11-25
URL: WS-2018-0210
CVSS 2 Score Details (3.5)
Base Score Metrics not available
Suggested Fix
Type: Change files
Origin: lodash/lodash@90e6199
Release Date: 2018-08-31
Fix Resolution: Replace or update the following files: lodash.js, test.js
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: