Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2020-8203

high

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Vendor / product: Lodash — lodash

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

CVSS
7.4
7.4 (CVSS v3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2020-07-15 17:15
Modified: 2026-11-02 18:18
NVD status: Modified
Last synced 9 hours ago
Verified against the source API 2026-11-03 07:33 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

lodash / lodash <4.17.20
oracle / banking_corporate_lending_process_management 14.2.0, 14.3.0, 14.5.0
oracle / banking_credit_facilities_process_management 14.2.0, 14.3.0, 14.5.0
oracle / banking_extensibility_workbench 14.2.0, 14.3.0, 14.5.0
oracle / banking_liquidity_management 14.2.0, 14.3.0, 14.5.0
oracle / banking_supply_chain_finance 14.2.0, 14.3.0, 14.5.0
oracle / banking_trade_finance_process_management 14.2.0, 14.3.0, 14.5.0
oracle / banking_virtual_account_management 14.2.0, 14.3.0, 14.5.0
oracle / blockchain_platform <21.1.2
oracle / communications_billing_and_revenue_management 7.5.0.23.0, 12.0.0.3.0
oracle / communications_cloud_native_core_policy 1.11.0
oracle / communications_session_border_controller 8.4, 9.0, cz8.4
oracle / communications_session_router cz8.4
oracle / communications_subscriber-aware_load_balancer cz8.3, cz8.4
oracle / enterprise_communications_broker 3.2.0, 3.3.0, pcz3.3
oracle / jd_edwards_enterpriseone_tools ≤9.2.6.0
oracle / peoplesoft_enterprise_peopletools 8.58, 8.59
oracle / primavera_gateway ≥17.12.0 ≤17.12.11, ≥18.8.0 ≤18.8.12, ≥19.12.0 ≤19.12.11, ≥20.12.0 ≤20.12.7

Weakness classification (CWE)

CWE-770 CWE-1321

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/lodash/lodash/issues/4874
Vendor advisory: https://github.com/lodash/lodash/issues/4874
Patch / mitigation: https://www.oracle.com//security-alerts/cpujul2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuApr2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuapr2022.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpujan2022.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2021.html
Patch / mitigation: https://www.oracle.com//security-alerts/cpujul2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuApr2021.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuapr2022.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpujan2022.html
Patch / mitigation: https://www.oracle.com/security-alerts/cpuoct2021.html

References

Data sources

NVD CVE API 2.0 — fetched 2026-11-03 07:33 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2026-4800