CVE-2019-10744
CRITICAL 9.1EPSS 5.0%
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
- CVSS v3.1
- 9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS v3.1
- 9.1 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H - CVSS v2.0
- 6.4 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:P - EPSS
- 5.01% chance of exploitation in the next 30 days, 92th percentile
- Published
- 2019-07-25
- Updated
- 2024-08-04
Proof-of-concept exploits (3)
- https://snyk.io/vuln/SNYK-JS-LODASH-450202
- ossf-cve-benchmark/CVE-2019-107440★ · 2020-12-08
- threemonkeysconsulting/dependabot-jira-sync-action2★ · 2026-04-23