balderdashy / balderdashy/sails

@sailshq/lodash is not patched for all historic lodash prototype pollution bugs

Open
#7,325 2 comments 0 reactions 0 assignees View on GitHub
resolved
Dominant language
JavaScript
Stars
22.8k
Forks
1.9k
PR merge metrics
No merged PRs in 30d

Description

version: 3.10.2
included in sails version: 1.5.9

See: https://github.com/advisories/GHSA-p6mc-m468-83gw

Contributor guide

Open the contributing guide

Research direction

Start with the reported @sailshq/lodash version 3.10.2 in Sails 1.5.9 and review the linked GHSA-p6mc-m468-83gw advisory. Trace how this dependency is selected, then verify that the resulting version covers the historic lodash prototype-pollution bugs. Done means the packaged dependency is patched and the affected Sails version no longer carries the advisory.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
backend, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.