CVE-2019-10744
CRITICAL 9.1EPSS 5.0%
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- Affected
- Snyk · lodash
- CVSS v3.1 NVD
- 9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS v2.0 NVD
- 6.4 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:P - EPSS
- 5.01% chance of exploitation in the next 30 days, 92nd percentile
- Published
- 2019-07-25
- Updated
- 2024-08-04
Proof-of-concept exploits (3)
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- ossf-cve-benchmark/CVE-2019-107440★ · 2020-12-08
- threemonkeysconsulting/dependabot-jira-sync-action2★ · 2026-04-23
Security advisories
- https://access.redhat.com/errata/RHSA-2019:3024
- https://security.netapp.com/advisory/ntap-20191004-0005
- https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- advisories/GHSA-jf85-cpcp-j695