Read the docs
TI-2020-06621 Aliases CVE-2020-8203GHSA-p6mc-m468-83gw

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Priority MEDIUM 41CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · High · High
Fix status
Partial Red Hat: 7 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05213 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial lodash (npm): 4.17.19lodash-es (npm): 4.17.20+1 more productRed Hat: 7 advisoriesRed Hat: 7 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—lodashNot Fixed—No fix listedCNA
—lodash (npm)3.7.0 to before 4.17.194.17.19Patch availableGHSA-p6mc-m468-83gw
—lodash-es (npm)3.7.0 to before 4.17.204.17.20Patch availableGHSA-p6mc-m468-83gw
—lodash.pick (npm)4.0.0 – 4.4.0—No fix listedGHSA-p6mc-m468-83gw
—lodash.set (npm)3.7.0 – 4.3.2—No fix listedGHSA-p6mc-m468-83gw
—lodash.setwith (npm)up to 4.3.2—No fix listedGHSA-p6mc-m468-83gw
—lodash.update (npm)up to 4.10.2—No fix listedGHSA-p6mc-m468-83gw
—lodash.updatewith (npm)up to 4.10.2—No fix listedGHSA-p6mc-m468-83gw
—lodash-rails (RubyGems)3.7.0 to before 4.17.194.17.19Patch availableGHSA-p6mc-m468-83gw
  • lodash Vendor— Affected Not Fixed Fixed in — No fix listed CNA
  • lodash (npm) Vendor— Affected 3.7.0 to before 4.17.19 Fixed in 4.17.19 Patch available GHSA-p6mc-m468-83gw
  • lodash-es (npm) Vendor— Affected 3.7.0 to before 4.17.20 Fixed in 4.17.20 Patch available GHSA-p6mc-m468-83gw
  • lodash.pick (npm) Vendor— Affected 4.0.0 – 4.4.0 Fixed in — No fix listed GHSA-p6mc-m468-83gw
  • lodash.set (npm) Vendor— Affected 3.7.0 – 4.3.2 Fixed in — No fix listed GHSA-p6mc-m468-83gw
  • lodash.setwith (npm) Vendor— Affected up to 4.3.2 Fixed in — No fix listed GHSA-p6mc-m468-83gw
  • lodash.update (npm) Vendor— Affected up to 4.10.2 Fixed in — No fix listed GHSA-p6mc-m468-83gw
  • lodash.updatewith (npm) Vendor— Affected up to 4.10.2 Fixed in — No fix listed GHSA-p6mc-m468-83gw
  • lodash-rails (RubyGems) Vendor— Affected 3.7.0 to before 4.17.19 Fixed in 4.17.19 Patch available GHSA-p6mc-m468-83gw

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*before 4.17.20Vulnerablelodash
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
  • cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* Versions before 4.17.20 Vulnerable ·lodash
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:banking_liquidity_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_liquidity_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_liquidity_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*14.2.0VulnerableOracle
cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*14.3.0VulnerableOracle
cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*14.5.0VulnerableOracle
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*before 21.1.2VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*7.5.0.23.0VulnerableOracle
cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:*1.11.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:*8.4VulnerableOracle
cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:*9.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:*cz8.4VulnerableOracle
cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:*cz8.4VulnerableOracle
cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:*cz8.3VulnerableOracle
cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:*cz8.4VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:*3.3.0VulnerableOracle
cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:*pcz3.3VulnerableOracle
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*up to 9.2.6.0VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*8.58VulnerableOracle
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*8.59VulnerableOracle
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7VulnerableOracle
  • cpe:2.3:a:oracle:banking_liquidity_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_liquidity_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_liquidity_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:* Versions 7.5.0.23.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:* Versions cz8.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:* Versions cz8.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:* Versions cz8.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:* Versions cz8.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:* Versions 3.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:* Versions pcz3.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions up to 9.2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-p6mc-m468-83gw lodash (npm) Fixed in 4.17.19 Advisory →
  • Fix · GHSA-p6mc-m468-83gw lodash-es (npm) Fixed in 4.17.20 Advisory →
  • Fix · GHSA-p6mc-m468-83gw lodash-rails (RubyGems) Fixed in 4.17.19 Advisory →

Red Hat 7 advisories

  • RHSA-2021:3917 Released 2021-10-19 · Red Hat rating Important
    Red Hat Quay v3.6.0 security, bug fix and enhancement update
    • Quay v3 quay/quay-rhel8
  • RHSA-2020:5611 Released 2020-12-17 · Red Hat rating Important
    Red Hat Virtualization security, bug fix, and enhancement update
    • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host-4.4.3-20201210.0.el8_3, redhat-virtualization-host-image-update-4.4.3-20201210.0.el8_3
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts cockpit-ovirt-0.14.15-1.el8ev, cockpit-ovirt-dashboard-0.14.15-1.el8ev
  • RHSA-2020:5179 Released 2020-11-24 · Red Hat rating Low
    Red Hat Virtualization security, bug fix, and enhancement update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.4.3.8-0.1.el8ev, ovirt-engine-backend-4.4.3.8-0.1.el8ev, ovirt-engine-dbscripts-4.4.3.8-0.1.el8ev +18
Show 4 more Red Hat advisories
  • RHSA-2020:4298 Released 2020-10-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.1 image security update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-ansible-operator, openshift4/ose-aws-machine-controllers, openshift4/ose-azure-machine-controllers +47
  • RHSA-2020:3807 Released 2020-09-23 · Red Hat rating Moderate
    Red Hat Virtualization security, bug fix, and enhancement update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.4.2.3-0.6.el8ev, ovirt-engine-backend-4.4.2.3-0.6.el8ev, ovirt-engine-dbscripts-4.4.2.3-0.6.el8ev +19
  • RHSA-2020:3369 Released 2020-08-06 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh security update
    • OpenShift Service Mesh 1.1 ior-1.1.6-1.el8, servicemesh-1.1.6-1.el8, servicemesh-citadel-1.1.6-1.el8 +12
    • Red Hat OpenShift Service Mesh 1.1 kiali-v1.12.10.redhat2-1.el7
  • RHSA-2020:3370 Released 2020-08-06 · Red Hat rating Low
    Red Hat OpenShift Jaeger 1.17.6 container images security update
    • Red Hat OpenShift Jaeger 1.17 distributed-tracing/jaeger-agent-rhel7, distributed-tracing/jaeger-all-in-one-rhel7, distributed-tracing/jaeger-collector-rhel7 +5

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 1AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat Virtualization 4AffectedNo fix yet
OpenShift Service Mesh 1.1Fixed RHSA-2020:3369
Quay v3Fixed RHSA-2021:3917
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2020:3807, RHSA-2020:5179
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2020:4298
Red Hat OpenShift Jaeger 1.17Fixed RHSA-2020:3370
Red Hat OpenShift Service Mesh 1.1Fixed RHSA-2020:3369
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2020:5611
Not affected: 7 products
  • Quay v3
  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat Virtualization 4 Hypervisor for RHEL 8
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8203
  2. 2026-10-03 Alias added: GHSA-p6mc-m468-83gw
  3. 2026-11-02 CISA SSVC decision points changed

References

Exploit 1

Patch 5

Advisory 3

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences