Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security vulnerability found for dependency lodash #639

Closed
acazacu opened this issue Jul 11, 2019 · 2 comments · Fixed by #641
Closed

Security vulnerability found for dependency lodash #639

acazacu opened this issue Jul 11, 2019 · 2 comments · Fixed by #641
Labels
released

Comments

@acazacu
Copy link

acazacu commented Jul 11, 2019

The current release has a lodash dependency set to a fixed version. This version of lodash seems have a high severity security vulnerability.

lodash should be updated to fix the reported vulnerability.

CVE-2019-10744
More information
high severity
Vulnerable versions: < 4.17.13
Patched version: 4.17.13

Affected versions of lodash are vulnerable to Prototype Pollution.
The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
@landonreed landonreed mentioned this issue Jul 12, 2019
Merged
@BillRobitskeJr BillRobitskeJr mentioned this issue Jul 13, 2019
Closed
@jimthedev
Copy link
Member

Working on this right now. Thanks.

jimthedev pushed a commit that referenced this issue Jul 17, 2019
@landonreed @jimthedev
fix(deps): update dependency lodash to v4.17.14 [security] (#641)
1875a38 
* fix(deps): update dependency lodash to v4.17.14 [security]

fix #639

* chore(deps): update package-lock.json for lodash v4.17.14
@commitizen-bot
Copy link

🎉 This issue has been resolved in version 3.1.2 🎉

The release is available on:

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
released
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

fix(deps): update dependency lodash to v4.17.14 [security]
3 participants
@jimthedev @acazacu @commitizen-bot