Every CVE Search/ Get API key

CVE-2018-3721

Prototype Pollution in lodash

6.5 MediumFix available

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

2.35%Down 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Record
CVE-2018-3721
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness
CWE-471, CWE-1321
Updated
2026-11-02
CVE List No score

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Record
CVE-2018-3721
Weakness
CWE-471
Updated
2026-11-02
EUVDEUVD-2018-0265 No score

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Record
EUVD-2018-0265
Updated
2026-11-03
GitHub AdvisoriesGHSA-fvqr-27wr-82fm 6.5

Prototype Pollution in lodash

Versions of lodash before 4.17.5 are vulnerable to prototype pollution.

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.

Recommendation

Update to version 4.17.5 or later.

Record
GHSA-fvqr-27wr-82fm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-471, CWE-1321
Updated
2026-11-02
OSVAZL-45420 6.5

CVE-2018-3721 affecting package js-jquery 3.5.0-4

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Record
AZL-45420
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSV 6.5

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Record
CVE-2018-3721
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2018-3721 6.5

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Record
DEBIAN-CVE-2018-3721
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVGHSA-fvqr-27wr-82fm 6.5

Prototype Pollution in lodash

Versions of lodash before 4.17.5 are vulnerable to prototype pollution.

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of Object via __proto__ causing the addition or modification of an existing property that will exist on all objects.

Recommendation

Update to version 4.17.5 or later.

Record
GHSA-fvqr-27wr-82fm
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-1321, CWE-471
Updated
2026-11-02
OSVUBUNTU-CVE-2018-3721 6.5

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Record
UBUNTU-CVE-2018-3721
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVCLSA-2026-1773188140 No score

TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 3.10.1-tuxcare.2.

Record
CLSA-2026-1773188140
Updated
2026-11-02
OSVCLSA-2026-1775262599 No score

TuxCare security update for 11 packages (4 CVEs)

TuxCare rebuilt 11 packages to address 4 CVEs. Fixed in 3.2.0-tuxcare.1.

Record
CLSA-2026-1775262599
Updated
2026-11-02
OSVCLSA-2026-1775262601 No score

TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 1.3.1-tuxcare.1.

Record
CLSA-2026-1775262601
Updated
2026-11-02
OSVCLSA-2026-1775262602 No score

TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 2.4.2-tuxcare.1.

Record
CLSA-2026-1775262602
Updated
2026-11-02
OSVCLSA-2026-1777336764 No score

TuxCare security update for lodash (6 CVEs)

TuxCare rebuilt lodash to address 6 CVEs. Fixed in 4.18.1-tuxcare.1.

Record
CLSA-2026-1777336764
Updated
2026-11-02
OSVCLSA-2026-1784250516 No score

TuxCare security update for lodash (1 CVE)

TuxCare rebuilt lodash to address 1 CVE. Fixed in 4.17.4-tuxcare.1.

Record
CLSA-2026-1784250516
Updated
2026-11-02
OSVCLSA-2026-1791290323 No score

TuxCare security update for lodash (3 CVEs)

TuxCare rebuilt lodash to address 3 CVEs. Fixed in 2.3.0-tuxcare.1.

Record
CLSA-2026-1791290323
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lodash
npm
 before 4.17.5
4.17.5
lodash-rails
RubyGems
 before 4.17.5
4.17.5
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
lodash
TuxCare:npm
 3.10.1-tuxcare.0 up to 3.10.1-tuxcare.2, plus listed versions
3.10.13.10.1-tuxcare.1
3.10.1-tuxcare.2
lodash
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash._basematches
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash._createwrapper
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.endswith
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.escape
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.isplainobject
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
lodash.parseint
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.startswith
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.unescape
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.uniqueid
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.words
TuxCare:npm
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash
TuxCare:npm
 1.3.1-tuxcare.0 up to 1.3.1-tuxcare.1, plus listed versions
1.3.1
1.3.1-tuxcare.1
lodash
TuxCare:npm
 2.4.2-tuxcare.0 up to 2.4.2-tuxcare.1, plus listed versions
2.4.2
2.4.2-tuxcare.1
lodash
TuxCare:npm
 4.18.1-tuxcare.0 up to 4.18.1-tuxcare.1, plus listed versions
4.18.1
4.18.1-tuxcare.1
lodash
TuxCare:npm
 4.17.4-tuxcare.0 up to 4.17.4-tuxcare.1, plus listed versions
4.17.4
4.17.4-tuxcare.1
lodash
TuxCare:npm
 2.3.0-tuxcare.0 up to 2.3.0-tuxcare.1, plus listed versions
2.3.0
2.3.0-tuxcare.1
node-lodash
Debian:12
 before 4.17.11+dfsg-1
4.17.11+dfsg-1
node-lodash
Debian:13
 before 4.17.11+dfsg-1
4.17.11+dfsg-1
node-lodash
Debian:14
 before 4.17.11+dfsg-1
4.17.11+dfsg-1
lodash-rails
RubyGems
 before 4.17.5, plus listed versions
0.10.00.7.00.8.10.8.20.9.0
Show 45 moreShow less
0.9.10.9.21.0.0.rc.11.0.0.rc.21.0.0.rc.31.0.11.1.01.1.11.2.01.2.11.3.12.0.02.1.02.2.02.2.12.3.02.4.02.4.13.1.03.10.03.10.13.2.03.3.03.3.13.3.1.13.4.03.5.03.6.03.7.03.9.34.0.04.11.24.12.04.13.14.14.14.15.04.16.14.16.34.16.44.16.64.17.24.17.44.3.04.5.14.6.1
4.17.5
node-lodash
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.4.1+dfsg-32.4.1+dfsg-3ubuntu0.1~esm1
 None known
node-lodash
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
4.17.4+dfsg-14.17.4+dfsg-1ubuntu0.1~esm1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-3721 is a medium vulnerability (CVSS 6.5) in Hackerone Lodash Node Module, published June 7, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in lodash 4.17.5.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open