Vulnerability · Published Jul 15, 2020 · Assigned by hackerone
CVE-2020-8203
High 7.4
In plain English
A high-severity resource allocation without limits in lodash. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 5.2% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.4High
Exploit odds (30 days)5.2%top 7.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-lodash | 4.17.19+dfsg-1 | DEBIAN-CVE-2020-8203 |
| Debian:13 | node-lodash | 4.17.19+dfsg-1 | DEBIAN-CVE-2020-8203 |
| Debian:14 | node-lodash | 4.17.19+dfsg-1 | DEBIAN-CVE-2020-8203 |
| RubyGems | lodash-rails | 4.17.19 | GHSA-p6mc-m468-83gw |
| Ubuntu:25.10 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 | USN-8411-1 |
| npm | lodash | 4.17.19 | GHSA-p6mc-m468-83gw |
| npm | lodash-es | 4.17.20 | GHSA-p6mc-m468-83gw |
| npm | lodash.pick | no fix listed | GHSA-p6mc-m468-83gw |
| npm | lodash.set | no fix listed | GHSA-p6mc-m468-83gw |
| npm | lodash.setwith | no fix listed | GHSA-p6mc-m468-83gw |
| npm | lodash.update | no fix listed | GHSA-p6mc-m468-83gw |
| npm | lodash.updatewith | no fix listed | GHSA-p6mc-m468-83gw |
Affected products (as reported)
Weakness: CWE-770
References
- https://hackerone.com/reports/712065 x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20200724-0006/ x_refsource_CONFIRM
- https://github.com/lodash/lodash/issues/4874 x_refsource_MISC
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuoct2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC