CVE-2020-8203

HIGH7.4EPSS 2.5%

Prototype Pollution in lodash

Published: 7/15/2020Modified: 4/28/2026

Description

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Affected packages (9)

Debian/node-lodashfrom 0, < 4.17.19+dfsg-1
npm/lodash>= 3.7.0, < 4.17.19
npm/lodash-es>= 3.7.0, < 4.17.20
npm/lodash.pick>= 4.0.0, <= 4.4.0
npm/lodash.set>= 3.7.0, <= 4.3.2
npm/lodash.setwithfrom 0, <= 4.3.2
npm/lodash.updatefrom 0, <= 4.10.2
npm/lodash.updatewithfrom 0, <= 4.10.2
RubyGems/lodash-rails>= 3.7.0, < 4.17.19

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.4	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

References (13)