lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith fun...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

出典: OSV.dev (Open Source Vulnerabilities) OSV

影響パッケージ

Debian:12 node-lodash

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.11+dfsg-1"}]}]

Debian:13 node-lodash

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.11+dfsg-1"}]}]

Debian:14 node-lodash

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.11+dfsg-1"}]}]

参照URL

advisory security-tracker.debian.org