CVE-2020-8203: Lodash

High severity, CVSS 7.4. EPSS: 5.2% chance of exploitation in the next 30 days.

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Affected products

Lodash Lodash: before 4.17.20 (fixed in 4.17.20)
Oracle Banking Corporate Lending Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Banking Credit Facilities Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Banking Extensibility Workbench: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Banking Liquidity Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Banking Supply Chain Finance: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Banking Trade Finance Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Banking Virtual Account Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
Oracle Blockchain Platform: before 21.1.2 (fixed in 21.1.2)
Oracle Communications Billing And Revenue Management: version 7.5.0.23.0 only; version 12.0.0.3.0 only
Oracle Communications Cloud Native Core Policy: version 1.11.0 only
Oracle Communications Session Border Controller: version 8.4 only; version 9.0 only; version cz8.4 only
Oracle Communications Session Router: version cz8.4 only
Oracle Communications Subscriber-Aware Load Balancer: version cz8.3 only; version cz8.4 only
Oracle Enterprise Communications Broker: version 3.2.0 only; version 3.3.0 only; version pcz3.3 only
Oracle Jd Edwards Enterpriseone Tools: up to and including 9.2.6.0
Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
Oracle Primavera Gateway: from 17.12.0, up to and including 17.12.11; from 18.8.0, up to and including 18.8.12; from 19.12.0, up to and including 19.12.11; from 20.12.0, up to and including 20.12.7

Published 2020-07-15. Last modified 2026-06-17.