[GHSA-xxjr-mmjv-4gpg] Lodash has Prototype Pollution Vulnerability in _.unset and _.omit functions - #9211
Conversation
|
Hi there @UlisesGascon! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository. This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Updates an existing GitHub-reviewed advisory for Lodash prototype pollution to reflect additional impacted APIs and revised severity metadata.
Changes:
- Expands the affected surface area to include
_.pullAtin the summary/details. - Removes the CVSS v3.1 severity entry, keeping only CVSS v4.0 (with an updated vector).
- Raises the advisory severity label from
MODERATEtoHIGH.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "severity": [ | ||
| { | ||
| "type": "CVSS_V3", | ||
| "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L" | ||
| }, | ||
| { | ||
| "type": "CVSS_V4", | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P" | ||
| "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H" | ||
| } | ||
| ], |
There was a problem hiding this comment.
It wasn't a CVSS v3.1. The old one was also a CVSS4.0. Look at the changeset.
| "CWE-1321" | ||
| ], | ||
| "severity": "MODERATE", | ||
| "severity": "HIGH", |
There was a problem hiding this comment.
All of this is a result of the form used on Github to "improve this finding". It gave me errors on the existing CVSS without me changing it. So reverting this part is a good idea.
There was a problem hiding this comment.
@copilot Revert the CVSS and severity part of this change
|
@copilot Revert the CVSS and severity change |
|
This is what automatically happens on https://github.com/advisories/GHSA-xxjr-mmjv-4gpg/improve : 
|
|
Closing and resubmitting |
Updates
Comments
_.pullAtwas also vulnerable and fixed with the rest