WS-2018-0210 Low Severity Vulnerability detected by WhiteSource
mend-bolt-for-github opened this issue · comments
WS-2018-0210 - Low Severity Vulnerability
Vulnerable Libraries - lodash-3.10.1.tgz, lodash-1.0.2.tgz
lodash-3.10.1.tgz
The modern build of lodash modular utilities.
path: /ninjecture/node_modules/lodash/package.json
Library home page: http://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz
Dependency Hierarchy:
- ❌ lodash-3.10.1.tgz (Vulnerable Library)
lodash-1.0.2.tgz
A utility library delivering consistency, customization, performance, and extras.
path: /ninjecture/node_modules/globule/node_modules/lodash/package.json
Library home page: http://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz
Dependency Hierarchy:
- ❌ lodash-1.0.2.tgz (Vulnerable Library)
Vulnerability Details
In the node_module "lodash" before version 4.17.11 the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.
Publish Date: 2018-11-25
URL: WS-2018-0210
Suggested Fix
Type: Change files
Origin: lodash/lodash@90e6199
Release Date: 2018-08-31
Fix Resolution: Replace or update the following files: lodash.js, test.js
Step up your Open Source Security Game with WhiteSource here