TI-2018-02719 Aliases CVE-2018-3721 GHSA-fvqr-27wr-82fm

Prototype pollution in HackerOne lodash node module

LOW 33CWE-471Published 2018-06-07 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Why it matters now

EPSS 0.02347 83rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial lodash node module (HackerOne): 4.17.5lodash (npm): 4.17.5+1 more productRed Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
HackerOne	lodash node module	before 4.17.5	4.17.5	Patch available	CNA
—	lodash (npm)	before 4.17.5	4.17.5	Patch available	GHSA-fvqr-27wr-82fm
—	lodash-rails (RubyGems)	before 4.17.5	4.17.5	Patch available	GHSA-fvqr-27wr-82fm

lodash node module VendorHackerOne Affected before 4.17.5 Fixed in 4.17.5 Patch available CNA
lodash (npm) Vendor— Affected before 4.17.5 Fixed in 4.17.5 Patch available GHSA-fvqr-27wr-82fm
lodash-rails (RubyGems) Vendor— Affected before 4.17.5 Fixed in 4.17.5 Patch available GHSA-fvqr-27wr-82fm

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:lodash:lodash::::::node.js::*	before 4.17.5	Vulnerable	lodash
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::	not specified by NVD	Vulnerable	NetApp
cpe:2.3:a:netapp:system_manager:9.0:::::::*	9.0	Vulnerable	NetApp

cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* Versions before 4.17.5 Vulnerable ·lodash
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
cpe:2.3:a:netapp:system_manager:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·NetApp

Remediation

Fix · CNA lodash node module (HackerOne) Fixed in 4.17.5
Fix · GHSA-fvqr-27wr-82fm lodash (npm) Fixed in 4.17.5 Advisory →
Fix · GHSA-fvqr-27wr-82fm lodash-rails (RubyGems) Fixed in 4.17.5 Advisory →

Red Hat 1 advisory

RHSA-2021:3917 Released 2021-10-19 · Red Hat rating Important
Red Hat Quay v3.6.0 security, bug fix and enhancement update
- Quay v3 quay/quay-rhel8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
CloudForms Management Engine 5	Affected	No fix planned: Will not fix
Red Hat OpenShift Enterprise 3	Affected	No fix planned: Will not fix
Red Hat Virtualization 4	Affected	No fix planned: Out of support scope
Quay v3	Fixed	RHSA-2021:3917

Not affected: 3 products

Quay v3
Red Hat Mobile Application Platform 4
Red Hat Virtualization 4

Timeline

2026-10-02 Threatist record created from CVE-2018-3721
2026-10-03 Alias added: GHSA-fvqr-27wr-82fm

References

Exploit 1

https://hackerone.com/reports/310443

Patch 1

https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences