This demonstrates a critical prototype pollution vulnerability in Lodash versions prior to 4.17.12.
The vulnerability allows attackers to modify the Object prototype, which can lead to application crashes, property injection, or even remote code execution in some contexts.
CVSS Score: 9.8 (Critical)
Affected Function: _.defaultsDeep()
Fixed Version: 4.17.12
Current Version: 4.17.11
Enter a JSON payload that uses constructor.prototype notation to pollute the Object prototype:
Run the test to see results
Run the test to see results
Prototype pollution allows attackers to add properties to global JavaScript object prototypes, which affects all objects inheriting from them.
The problem in Lodash occurs because _.defaultsDeep() doesn't properly validate keys when merging objects, allowing attackers to modify the Object prototype.
In production applications, this can lead to property injection, bypass application security mechanisms, and in some cases, even lead to remote code execution.