title: How can lodash defaultsDeep be exploited?
body: <p>I understand what <a href="https://snyk.io/blog/snyk-research-team-discovers-severe-prototype-pollution-security-vulnerabilities-affecting-all-versions-of-lodash/" rel="nofollow noreferrer">lodash prototype pollution security vulnerabilities</a> are, especially the function <code>defaultsDeep</code> could be tricked into adding or modifying properties of Object.prototype. </p>
  
  <p>But I don't see how that can be exploited, after all the affected js code running in his own browser sandbox. </p>
  
  <p>Even if the server is running nodejs I still don't see how can this problematic <code>defaultsDeep</code> function be exploited to my website vulnerable. </p>
  
  <p>PS, I are fully aware this question may be seen as too broad. But I face the resistance from other teams to upgrade our lodash version (as we have upgraded several times). A simple excuse like security vulnerabilities is not enough for them. I need to be specific. Hence the question.</p>
  
  <p>----- update -----</p>
  
  <p>I further check <a href="https://snyk.io/vuln/SNYK-JS-LODASH-450202" rel="nofollow noreferrer">Prototype Pollution report</a> for the types of attacks may happen. But I still get the feeling that DOS will happen only if we are using nodejs and only if the codes are careless enough to defaultsDeep the payload. And even with that it still unlikely to happen.</p>