Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

npm audit reports a Prototype Pollution

See original GitHub issue

Hello, ‘npm audit’ reports a ‘Prototype Pollution’ issue due to your ‘lodash’ < 4.17.5 dependency. Would you mind to check?


$ npm audit 
                                                                                
                       === npm audit security report ===                        
                                                                                
┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ quasar-cli [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ quasar-cli > ouch > lodash                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/577                       │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 1 low severity vulnerability in 13536 scanned packages
  1 vulnerability requires manual review. See the full report for details.

Many thanks Cheers, Francesco

Issue Analytics

State:
Created 5 years ago
Comments:5 (4 by maintainers)

Top GitHub Comments

1reaction

fansanellicommented, Sep 14, 2018

@harishanchu thank you, sir. Please let me know if you need any further information or help

0reactions

harishanchucommented, Sep 14, 2018

@fansanelli @ssuess Sorry, I didn’t get time to look into this. I will work on it this weekend.

Top Results From Across the Web

What is prototype pollution and why is it such a big deal?

Now before we all panic, prototype pollution isn't exactly an easy ... the npm-audit command and you can mostly fix it automatically.

npm-audit-report@1.1.0 vulnerabilities - Snyk

Learn more about npm-audit-report@1.1.0 vulnerabilities. npm-audit-report@1.1.0 ... Affected versions of this package are vulnerable to Prototype Pollution.

npm audit security report - Prototype Pollution #1146 - GitHub

=== npm audit security report === Manual Review Some vulnerabilities require your attention to resolve Visit https://go.npm.me/audit-guide for ...

Prototype Pollution - npm vulnerability can't be fixed?

I am starting a new react project, and I just installed the very basic package (npx create-react-app) without anything else. When I run...

yarn-audit-fix - npm

Start using yarn-audit-fix in your project by running `npm i ... 2s # npm audit report lodash <=4.17.18 Severity: high Prototype Pollution ......