CVE-2020-8203 Prototype Pollution in lodash
Prototype pollution in lodash allows attackers to inject properties into Object.prototype, potentially leading to remote code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8203?
CVE-2020-8203 is a high-severity code injection vulnerability in Oracle Communications Billing and Revenue Management, published on 15 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Which versions are affected by CVE-2020-8203?
16 open source packages ship an affected version, including lodash-rails, lodash and lodash-es. It affects 18 products.
| Package | Affected | Fixed in |
|---|---|---|
lodash-rails RubyGems | From 3.7.0 | 4.17.19 |
lodash-rails RubyGems | From 3.7.0 | 4.17.19 |
lodash npm | From 3.7.0 | 4.17.19 |
lodash npm | From 3.7.0 | 4.17.19 |
lodash-es npm | From 3.7.0 | 4.17.20 |
lodash-es npm | From 3.7.0 | 4.17.20 |
10 more packages
lodash.pick npm | From 4.0.0 to 4.4.0 | None |
lodash.pick npm | From 4.0.0 to 4.4.0 | None |
lodash.set npm | From 3.7.0 to 4.3.2 | None |
lodash.set npm | From 3.7.0 to 4.3.2 | None |
lodash.setwith npm | All versions to 4.3.2 | None |
lodash.setwith npm | All versions to 4.3.2 | None |
lodash.update npm | All versions to 4.10.2 | None |
lodash.update npm | All versions to 4.10.2 | None |
lodash.updatewith npm | All versions to 4.10.2 | None |
lodash.updatewith npm | All versions to 4.10.2 | None |
Products include Lodash Lodash, Oracle Banking Corporate Lending Process Management, Oracle Banking Credit Facilities Process Management, Oracle Banking Extensibility Workbench, Oracle Banking Liquidity Management, Oracle Banking Supply Chain Finance and 12 more.
How do I fix CVE-2020-8203?
Upgrade lodash-rails to 4.17.19 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-8203 being exploited?
There is no known exploitation of CVE-2020-8203 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Oracle Communications Billing and Revenue Management
- CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names
- CVE-2021-23337 Command Injection
- CVE-2025-13465 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
- CVE-2026-2950 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
- CVE-2019-1010266 Regular Expression Denial of Service (ReDoS) in lodash
All Oracle Communications Billing and Revenue Management vulnerabilities
Sources
Also known as AZL-44964, CLSA-2026-1775003201, DEBIAN-CVE-2020-8203, GHSA-p6mc-m468-83gw, MINI-98m6-gp67-3wj8, MINI-9r3v-w2r3-c4qg and 3 more.