lodash 4.17.15 The lodash package is vulnerable to Prototype Pollution.

[tlterry]

Hi WordPress,

I am having the following issue. Can you please have a look issue how do we resolve it? Thank you.

EXPLANATION
The lodash package is vulnerable to Prototype Pollution. The template function in lodash.js, template.js, and lodash.min.js does not account for unicode newline characters when filtering the sourceURL property of the options object. Because of how the options object is used, an attacker who can control the source URL can leverage this to alter properties on the prototype chain, which can cause other sections of code to behave in an arbitrary and malicious way.

Please note that this vulnerability is due to an incomplete fix in sonatype-2019-0500.

DETECTION
The application is vulnerable by using this component.

RECOMMENDATION
There is no non vulnerable version of this component/package. We recommend investigating alternative components or a potential mitigating control.

ROOT CAUSE
lodash-4.17.15.tgzMETA-INF/resources/webjars/lodash/4.17.15/template.js[4.17.13, )

[tlterry]

Both related files located at file path below.

lodash.js located at /wp-includes/js/dist/vendor
lodash.min.js located at /wp-includes/js/dist/vendor

[SergeyBiryukov]

Hi there, welcome to WordPress Trac!

4.17.15 is the ​current version of lodash, so it doesn't look like there are any actionable items for WordPress core here. When a new version is released, it will be updated as part of #49707.

For any potential issues in WordPress core, as already noted in comment:1:ticket:49735, please follow ​Reporting Security Vulnerabilities. Trac is not the correct place for these reports.