balderdashy / balderdashy/sails
@sailshq/lodash is not patched for all historic lodash prototype pollution bugs
Open
resolved
- Dominant language
- JavaScript
- Stars
- 22.8k
- Forks
- 1.9k
- PR merge metrics
- No merged PRs in 30d
Description
version: 3.10.2
included in sails version: 1.5.9
See: https://github.com/advisories/GHSA-p6mc-m468-83gw
Contributor guide
Research direction
Start with the reported @sailshq/lodash version 3.10.2 in Sails 1.5.9 and review the linked GHSA-p6mc-m468-83gw advisory. Trace how this dependency is selected, then verify that the resulting version covers the historic lodash prototype-pollution bugs. Done means the packaged dependency is patched and the affected Sails version no longer carries the advisory.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100