CVE-2020-8203: Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

This week

HIGH 7.4REMOTEUPGRADEDOWNGRADEDOWNGRADE

CVE-2020-8203 is a high-severity flaw (CVSS 7.4) affecting lodash, banking corporate lending process management, banking credit facilities process management. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Why this priority

High severity
EPSS top 7%: very likely to be exploited
Public exploit reference
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.4 (High)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	None
User interaction	None
EPSS exploit chance	5.2% (top 7%)
CISA exploited list	No
Weakness	CWE-770, CWE-1321
Published	2020-07-15
Last modified	2026-06-17

Publisher (CNA): HackerOne · Vendor: lodash · oracle

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2020-07-15 17:15 UTCPublished CVE record published
2026-06-17 03:26 UTCUpdated Record last modified

lodash lodash UPGRADE

Affected: < 4.17.20

Fixed in: 4.17.20

Safe to downgrade to: no unaffected older release

1. Check installed version

npm ls lodash

2. UPGRADE to 4.17.20

npm install lodash@">=4.17.20"

oracle banking corporate lending process management DOWNGRADE

Affected: 14.2.0 · 14.3.0 · 14.5.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.2.0

1. Check installed version

apt-cache policy banking-corporate-lending-process-management || rpm -q banking-corporate-lending-process-management || banking-corporate-lending-process-management --version

2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)

apt-cache madison banking-corporate-lending-process-management sudo apt install banking-corporate-lending-process-management=<VERSION_BEFORE_14.2.0> sudo apt-mark hold banking-corporate-lending-process-management

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-corporate-lending-process-management sudo dnf downgrade banking-corporate-lending-process-management-<VERSION_BEFORE_14.2.0> sudo dnf versionlock add banking-corporate-lending-process-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle banking credit facilities process management DOWNGRADE

Affected: 14.2.0 · 14.3.0 · 14.5.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.2.0

1. Check installed version

apt-cache policy banking-credit-facilities-process-management || rpm -q banking-credit-facilities-process-management || banking-credit-facilities-process-management --version

2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)

apt-cache madison banking-credit-facilities-process-management sudo apt install banking-credit-facilities-process-management=<VERSION_BEFORE_14.2.0> sudo apt-mark hold banking-credit-facilities-process-management

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-credit-facilities-process-management sudo dnf downgrade banking-credit-facilities-process-management-<VERSION_BEFORE_14.2.0> sudo dnf versionlock add banking-credit-facilities-process-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle banking extensibility workbench DOWNGRADE

Affected: 14.2.0 · 14.3.0 · 14.5.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.2.0

1. Check installed version

apt-cache policy banking-extensibility-workbench || rpm -q banking-extensibility-workbench || banking-extensibility-workbench --version

2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)

apt-cache madison banking-extensibility-workbench sudo apt install banking-extensibility-workbench=<VERSION_BEFORE_14.2.0> sudo apt-mark hold banking-extensibility-workbench

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-extensibility-workbench sudo dnf downgrade banking-extensibility-workbench-<VERSION_BEFORE_14.2.0> sudo dnf versionlock add banking-extensibility-workbench

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle banking liquidity management DOWNGRADE

Affected: 14.2.0 · 14.3.0 · 14.5.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.2.0

1. Check installed version

apt-cache policy banking-liquidity-management || rpm -q banking-liquidity-management || banking-liquidity-management --version

2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)

apt-cache madison banking-liquidity-management sudo apt install banking-liquidity-management=<VERSION_BEFORE_14.2.0> sudo apt-mark hold banking-liquidity-management

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-liquidity-management sudo dnf downgrade banking-liquidity-management-<VERSION_BEFORE_14.2.0> sudo dnf versionlock add banking-liquidity-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

oracle banking supply chain finance DOWNGRADE

Affected: 14.2.0 · 14.3.0 · 14.5.0

Fixed in: no fixed release known

Safe to downgrade to: a release before 14.2.0

1. Check installed version

apt-cache policy banking-supply-chain-finance || rpm -q banking-supply-chain-finance || banking-supply-chain-finance --version

2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)

apt-cache madison banking-supply-chain-finance sudo apt install banking-supply-chain-finance=<VERSION_BEFORE_14.2.0> sudo apt-mark hold banking-supply-chain-finance

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list banking-supply-chain-finance sudo dnf downgrade banking-supply-chain-finance-<VERSION_BEFORE_14.2.0> sudo dnf versionlock add banking-supply-chain-finance

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2020-8203?

lodash: upgrade to 4.17.20; banking corporate lending process management: downgrade or apply the listed mitigation; banking credit facilities process management: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2020-8203 being exploited?

CVE-2020-8203 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2020-8203 affect?

CVE-2020-8203 affects lodash, banking corporate lending process management, banking credit facilities process management. Severity is high (CVSS 7.4). Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

How urgent is CVE-2020-8203?

Priority 59/100. High severity; EPSS top 7%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action

Software pages

Lodash vulnerabilities

Related CVEs

CVE-2025-13465 MEDIUM 5.3 UPGRADE The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution
CVE-2021-23337 HIGH 7.2 UPGRADE DOWNGRADE Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-28500 MEDIUM 5.3 UPGRADE DOWNGRADE Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumb
CVE-2019-10744 CRITICAL 9.1 UPGRADE MITIGATE Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution
CVE-2019-1010266 MEDIUM 6.5 UPGRADE lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption

References

← Back to latest CVEs