CVE-2018-3721: Lodash

Medium severity, CVSS 6.5. EPSS: 2.4% chance of exploitation in the next 30 days.

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Affected products

• Lodash Lodash: before 4.17.5 (fixed in 4.17.5)
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp System Manager: version 9.0 only

Published 2018-06-07. Last modified 2026-06-17.