GMS-2018-10: Denial of Service and remote code execution

February 13, 2018

Functions in Lodash ( merge, mergeWith, defaultsDeep) can modify the prototype of “Object” if given malicious data. This can lead to denial of service or remote code execution.

References

github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
hackerone.com/reports/310443

Code Behaviors & Features

Detect and mitigate GMS-2018-10 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →