CVE-2020-8203: Prototype Pollution in lodash
Summary
CVE-2020-8203: Prototype Pollution in lodash. Affects lodash versions >= 3.7.0, < 4.17.19. Fixed in 4.17.19. How to fix ↓
Also tracked for
- node-lodash · Debian:11
The same CVE-2020-8203 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
lodash is a popular JavaScript utility library that provides helpful functions for manipulating and working with arrays, objects, and other data types. It is widely used in various applications and frameworks. However, versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution.
Vulnerability Detail
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object. In the case of lodash, the function zipObjectDeep is affected. If the property identifiers used for zipping objects are user-supplied, a malicious user can exploit this vulnerability to add or modify existing properties on all objects. This can potentially lead to Denial of Service or Code Execution under specific circumstances.
How To Fix
Latest published version: 4.18.1 as of 22 Oct 2026
npm install lodash@4.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.17.19
This is the first release that contains the fix.
npm install lodash@4.17.19Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating lodash is not immediately possible, a temporary workaround is to sanitize and validate user-supplied property identifiers before using them in the zipObjectDeep function. This can help prevent the exploitation of Prototype Pollution. Here's an example of how to sanitize the property identifiers:
const sanitizedProperties = userProperties.filter(property => typeof property === 'string');
By filtering out non-string values, you can mitigate the risk of Prototype Pollution.
Conclusion
Prototype Pollution in lodash (CVE-2020-8203) is a critical vulnerability that can lead to Denial of Service or Code Execution. It is important to update lodash to version 4.17.20 or higher to fix this issue. If immediate update is not possible, sanitizing and validating user-supplied property identifiers can provide temporary mitigation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for lodash →
FAQ
Prototype Pollution is a vulnerability that allows an attacker to modify the prototype of an object, leading to unexpected behavior or security issues.
Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution due to the zipObjectDeep function. If user-supplied property identifiers are used for zipping objects, an attacker can exploit this vulnerability.
This vulnerability can lead to Denial of Service or Code Execution under specific circumstances. By modifying the prototype of objects, an attacker can introduce malicious properties that affect the behavior of the application.
To fix this vulnerability, update lodash to version 4.17.20 or higher. This version includes a fix for the Prototype Pollution issue.
If updating lodash is not immediately possible, you can sanitize and validate user-supplied property identifiers before using them in the zipObjectDeep function. This can help mitigate the risk of Prototype Pollution.
References
Related vulnerabilities
Recent vulnerabilities recorded for lodash.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
