CVE-2019-10744
CriticalAdvisory
Published 10 Jul 2019In the index since 6 Sept 2026
- Severity
- Critical
- worst across findings
- CVSS
- 9.1
- base score, highest
- EPSS
- 0.050
- 92nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 51
- of 17,781 indexed, latest versions
- Container images
- 48
- deployed by those charts
- Fix available
- 2 of 2
- affected packages
Prototype Pollution in lodash
Carried by container images the latest versions of 51 of 17,781 indexed charts deploy, on 48 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| lodashnpm | 0.9.2, 1.0.2, 1.3.1, 2.4.1+8 more | 4.17.12 | 48 |
| lodash-esnpm | 4.17.4 | 4.17.14 | 1 |
- OSV records
- GHSA-jf85-cpcp-j695
- Also known as
- SNYK-JS-LODASH-450202
Charts affected
51 by stars
Container images carrying it
48 by charts deploying them
A fixed version is listed for 2 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| hyperledger/ | 4ce6f43ded2e | lodash | 4.17.12 | 4 |
| hyperledger/ | f6c724592abf | lodash | 4.17.12 | 4 |
| pantsel/ | c8172b75607d | lodash | 4.17.12 | 3 |
| governify/ | d3f37f4f8168 | lodash | 4.17.12 | 2 |
| l7mp/ | fd2b2d06fff6 | lodash | 4.17.12 | 2 |
| migmartri/ | 486aacfd5aa9 | lodash | 4.17.12 | 2 |
| mojaloop/ | d480a62103d6 | lodash | 4.17.12 | 2 |
| bastilimbach/ | 41b0835ab31e | lodash | 4.17.12 | 1 |
| billimek/ | 5814f0bcf5ba | lodash | 4.17.12 | 1 |
| catalysm/ | f003b35f54d9 | lodash | 4.17.12 | 1 |
| cnieg/ | 98ee05668915 | lodash | 4.17.12 | 1 |
| cryptexlabs/ | 189c07411d7c | lodash | 4.17.12 | 1 |
| daskdev/ | 052630f5ca04 | lodash | 4.17.12 | 1 |
| decayofmind/ | 1e18e92fe694 | lodash | 4.17.12 | 1 |
| dessalines/ | ee4c620d8e93 | lodash | 4.17.12 | 1 |
| ethereumex/ | a7603aa8df4c | lodash | 4.17.12 | 1 |
| fiware/ | d551a13e8278 | lodash | 4.17.12 | 1 |
| fiware/ | a1b6ed4ae84f | lodash | 4.17.12 | 1 |
| galaxy/ | 0267bad550e6 | lodash | 4.17.12 | 1 |
| hyperledger/ | c65891b6c237 | lodash | 4.17.12 | 1 |
| ibmcom/ | 240ff499eb5b | lodash | 4.17.12 | 1 |
| ibmcom/ | e2a86997b36b | lodash | 4.17.12 | 1 |
| ibmcom/ | 02d882f2836e | lodash | 4.17.12 | 1 |
| ibmcom/ | b8e8df11072d | lodash | 4.17.12 | 1 |
| ibmcom/ | ab3fd1fdfa18 | lodash | 4.17.12 | 1 |
| ibmcom/ | ed5505e5c7ec | lodash | 4.17.12 | 1 |
| ibmcom/ | e17bdccc5030 | lodash | 4.17.12 | 1 |
| konradkleine/ | 181aad54ee64 | lodash | 4.17.12 | 1 |
| koumoul/ | 8eeca2e8285b | lodash | 4.17.12 | 1 |
| linuxserver/ | 45c5fe102ff3 | lodash | 4.17.12 | 1 |
| matrixdotorg/ | 0d37b4d42b47 | lodash | 4.17.12 | 1 |
| microcks/ | cb72e46a1b3c | lodash | 4.17.12 | 1 |
| minddocdev/ | 6c60b11a4fa7 | lodash | 4.17.12 | 1 |
| muluder/ | 43b597a93da7 | lodash | 4.17.12 | 1 |
| omecproject/ | 5715e5648aa0 | lodash | 4.17.12 | 1 |
| openwhisk/ | b695a6ceb406 | lodash | 4.17.12 | 1 |
| parithoshj/ | cdca426fea6d | lodash | 4.17.12 | 1 |
| polonel/ | 0cf6513f6fe3 | lodash | 4.17.12 | 1 |
| socialmediamacroscope/ | c5095e94bc65 | lodash | 4.17.12 | 1 |
| timothyclarke/ | 22c41e5ca7e2 | lodash | 4.17.12 | 1 |
| wekanteam/ | 68a51f0327df | lodash | 4.17.12 | 1 |
| willwill/ | d443017aae98 | lodash | 4.17.12 | 1 |
| wiremind/ | e7048929a676 | lodash | 4.17.12 | 1 |
| quay.io/ | 86b71e90319f | lodash | 4.17.12 | 1 |
| quay.io/ | 7a4b9fedc724 | lodash | 4.17.12 | 1 |
| quay.io/ | c973e166a5dc | lodash | 4.17.12 | 1 |
| quay.io/ | cb17600883a3 | lodash | 4.17.12 | 1 |
| registry.gitlab.com/ | fda21b0a0344 | lodash lodash-es | 4.17.12 4.17.14 | 1 |