---
id: CVE-2020-8203
title: >-
  Prototype pollution attack when using _.zipObjectDeep in lodash before
  4.17.20.
summary: >-
  Prototype pollution attack when using _.zipObjectDeep in lodash before
  4.17.20.
severity: none
cwe:
  - CWE-770
product: lodash
affected:
  - lodash Not Fixed
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-02T17:56:15.725103Z'
exploitAvailable: true
published: '2020-07-15'
updated: '2026-11-02'
sourceUpdated: '2026-11-02T17:56:32.515Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2020-8203'
references:
  - url: 'https://hackerone.com/reports/712065'
  - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html'
  - url: 'https://security.netapp.com/advisory/ntap-20200724-0006/'
  - url: 'https://github.com/lodash/lodash/issues/4874'
  - url: 'https://www.oracle.com//security-alerts/cpujul2021.html'
  - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html'
  - url: 'https://www.oracle.com/security-alerts/cpujan2022.html'
  - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html'
tags:
  - cve.org
  - exploit-available
epss: 0.05213
epssPercentile: 0.92525
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/mcpmark-eval-liuhezi/audit-cve-2020-8203'
  checkedAt: '2026-11-05T19:31:18.368Z'
ingestedAt: '2026-11-05T19:30:42.757Z'
---

## Overview

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

## Affected

- `lodash Not Fixed`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.