CVE-2019-10744

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-1321

Affected software

Vendor	Product	Versions
Snyk	lodash	All versions prior to 4.17.12

References

https://access.redhat.com/errata/RHSA-2019:3024Third Party Advisory
https://security.netapp.com/advisory/ntap-20191004-0005/Third Party Advisory
https://snyk.io/vuln/SNYK-JS-LODASH-450202Exploit, Third Party Advisory
https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp%3Butm_medium=RSSThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3024Third Party Advisory
https://security.netapp.com/advisory/ntap-20191004-0005/Third Party Advisory
https://snyk.io/vuln/SNYK-JS-LODASH-450202Exploit, Third Party Advisory
https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp%3Butm_medium=RSSThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory

Timeline

Published: Jul 26, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-107457.5assign-deep is vulnerable to Prototype Pollution in versions before 0.4.8 and version 1.0.0. The function assign-deep could be tricked into CVE-2019-107469.8mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into ad CVE-2019-107479.8set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifyi CVE-2019-107489.8Sequelize all versions prior to 3.35.1, 4.44.3, and 5.8.11 are vulnerable to SQL Injection due to JSON path keys not being properly escaped CVE-2019-107499.8sequelize before version 3.35.1 allows attackers to perform a SQL Injection due to the JSON path keys not being properly sanitized in the Po CVE-2019-10756.1A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'.CVE-2019-107509.8deeply is vulnerable to Prototype Pollution in versions before 3.1.0. The function assign-deep could be tricked into adding or modifying pro CVE-2019-107518.8All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file CVE-2019-107529.8Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escap CVE-2019-107535.9In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to versi CVE-2019-107548.1Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID genera CVE-2019-107554.9The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes t