Skip to content

Lodash prototype pollution vulnerability #437

@vidhyadharmaraj

Description

@vidhyadharmaraj

https://snyk.io/blog/snyk-research-team-discovers-severe-prototype-pollution-security-vulnerabilities-affecting-all-versions-of-lodash/

It seems the last version of grunt-ts requires the following package(s):
csproj2ts inturn using vulnerable lodash version 4.17.4

Unfortunately, these packages have a dependency of lodash. https://snyk.io/vuln/npm:lodash fixed at version 4.17.12.

I'm just creating the issue to notify this fact and request a dependency update when the related packages are updated.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions