{"action":"Upgrade lodash to 4.17.11 or later.","affected":[{"fixed":"4.17.11","introduced":"0"}],"component":"lodash","cve_ids":["CVE-2018-16487"],"ecosystem":"npm","epss":0.01491,"exploited":false,"fixed_versions":["4.17.11"],"ghsa_id":"GHSA-4xc9-xhrj-v574","id":"tcs_01M5KEGQY6E8T6AZGTAVQWTN2V","modified_at":"2025-08-12T21:55:35.778975Z","published_at":"2019-02-07T18:16:48Z","references":["https://osv.dev/vulnerability/GHSA-4xc9-xhrj-v574","https://nvd.nist.gov/vuln/detail/CVE-2018-16487","https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad","https://hackerone.com/reports/380873","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-16487.yml","https://security.netapp.com/advisory/ntap-20190919-0004"],"severity":{"label":"medium","score":5.6},"sources":[{"source":"osv","source_id":"GHSA-4xc9-xhrj-v574","url":"https://osv.dev/vulnerability/GHSA-4xc9-xhrj-v574"},{"source":"nvd","source_id":"CVE-2018-16487","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-16487"}],"summary":"Prototype Pollution in lodash"}