CVE-2020-8203

7.4

HIGHCVSS v3

Published

July 15, 2020

CVSS v2

5.8 MEDIUM

Affected

13 projects

Assigned by

[email protected]

Severity scale

010

Description

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

lodash

NPMLodash modular utilities.

< 4.17.20, >= 3.7.0, < 4.17.19NVD

lodash-es

NPMLodash exported as ES modules.

>= 3.7.0, < 4.17.20OSV

lodash.pick

NPM

More on this CVE

NVD↗GitHub Advisory↗

The lodash method `_.pick` exported as a module.

>= 4.0.0, <= 4.4.0OSV

@types/lodash

NPMTypeScript definitions for lodash

< 4.17.20, >= 3.7.0, < 4.17.19NVD

lodash.set

NPMThe lodash method `_.set` exported as a module.

>= 3.7.0, <= 4.3.2OSV

@snyk/lodash

NPM[Site](https://lodash.com/) | [Docs](https://lodash.com/docs) | [FP Guide](https://github.com/lodash/lodash/wiki/FP-Guide) | [Contributing](https://github.com/lodash/lodash/blob/master/.github/CONTRIBUTING.md) | [Wiki](https://github.com/lodash/lodash/wik

< 4.17.20, >= 3.7.0, < 4.17.19NVD

FGRibreau/lodash

GitHub:trumpet: My own version of lodash with extra mixins

< 4.17.20, >= 3.7.0, < 4.17.19NVD

@sailshq/lodash

NPMA fork of Lodash 3.10.x with ongoing maintenance from the Sails core team.

< 4.17.20, >= 3.7.0, < 4.17.19NVD

sailshq/lodash

GitHubA fork of Lodash 3.10.x with ongoing maintenance from the Sails core team. **There will be no changes or additions to existing usage. (That means no new features.)**

< 4.17.20, >= 3.7.0, < 4.17.19NVD

treelinehq/lodash

GitHub

< 4.17.20, >= 3.7.0, < 4.17.19NVD

lodash/lodash

GitHubA modern JavaScript utility library delivering modularity, performance, & extras.

< 4.17.20, >= 3.7.0, < 4.17.19NVD