# CVE-2020-8203: lodash prototype pollution in property mutation functions

Source: https://junglewise.ai/threats/cve-2020-8203-lodash-prototype-pollution-in-property-mutation-functions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-07-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-8203 · Severity: low · CVSS 3.1 · Published 2020-07-15

lodash is a popular JavaScript utility library used in thousands of applications to simplify data manipulation. This vulnerability allows attackers to pollute the Object prototype when using certain lodash functions with user-controlled input, potentially leading to denial of service or code execution across an application. Affected applications may crash or behave unexpectedly when the polluted prototype properties interfere with normal object operations.

Technologies: [lodash (npm)](https://junglewise.ai/threats/technologies/lodash), [lodash-es (npm)](https://junglewise.ai/threats/technologies/lodash-es), [lodash-rails (RubyGems)](https://junglewise.ai/threats/technologies/lodash-rails). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [RubyGems](https://junglewise.ai/threats/vendors/rubygems).

## Quick answers

**Is CVE-2020-8203 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-8203 being exploited in the wild.

**How severe is CVE-2020-8203?** Low severity, with a CVSS score of 3.1, published 15 July 2020.

**Which products and versions are affected?** lodash (npm) SEMVER:introduced=3.7.0,fixed=4.17.19; lodash-es (npm) SEMVER:introduced=3.7.0,fixed=4.17.20; lodash.pick (npm) SEMVER:introduced=4.0.0,last_affected=4.4.0; lodash.set (npm) SEMVER:introduced=3.7.0,last_affected=4.3.2; and 4 more.

**Is there a fix for CVE-2020-8203?** Yes. lodash (npm): upgrade to 4.17.19 or later; lodash-es (npm): upgrade to 4.17.20 or later; lodash-rails (RubyGems): upgrade to 4.17.19 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-8203 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-8203?** Check whether you run lodash (npm), lodash-es (npm), lodash.pick (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- lodash (npm): upgrade to 4.17.19 or later

  ```sh
  npm install lodash@4.17.19
  ```

- lodash-es (npm): upgrade to 4.17.20 or later

  ```sh
  npm install lodash-es@4.17.20
  ```

- lodash-rails (RubyGems): upgrade to 4.17.19 or later

  ```sh
  bundle update lodash-rails
  ```


## Technical details

This is a prototype pollution vulnerability in lodash functions (pick, set, setWith, update, updateWith, and zipObjectDeep) that occurs when property identifiers are derived from user-supplied input. An attacker can craft malicious property paths that modify the Object.prototype, injecting properties that propagate to all JavaScript objects in the runtime. The vulnerability requires the application to manipulate objects based on user-provided property values or arrays; no authentication is needed, and it is reachable over the network. Exploitation can cause denial of service through object pollution or, under specific application circumstances, achieve arbitrary code execution. Patches are available in lodash 4.17.19 and later versions.

## Affected products

- lodash lodash 3.7.0 to 4.17.18
- lodash lodash-es 3.7.0 to 4.17.19
- lodash lodash.pick 4.0.0 to 4.4.0
- lodash lodash.set 3.7.0 to 4.3.2
- lodash lodash.setwith all versions to 4.3.2
- lodash lodash.update all versions to 4.10.2
- lodash lodash.updatewith all versions to 4.10.2
- lodash lodash-rails 3.7.0 to 4.17.18

## Identifiers

- CVE-2020-8203
- GHSA-p6mc-m468-83gw

## Timeline

- 2020-07-15: disclosed
- 2020-07-15: patched: lodash 4.17.19 and lodash-es 4.17.20 released

## References

- [https://github.com/lodash/lodash/issues/4744](https://github.com/lodash/lodash/issues/4744)

## Related threats

- [lodash vulnerable to Code Injection via `_.template` imports key names](https://junglewise.ai/threats/cve-2021-23337-lodash-command-injection-in-template-function)
- [Lodash prototype pollution in unset and omit functions](https://junglewise.ai/threats/cve-2026-2950-lodash-prototype-pollution-in-unset-and-omit-functions)
- [Lodash prototype pollution in _.unset and _.omit functions](https://junglewise.ai/threats/cve-2025-13465-lodash-prototype-pollution-in-unset-and-omit-functions)
- [lodash ReDoS in toNumber and trim functions](https://junglewise.ai/threats/cve-2020-28500-lodash-redos-in-tonumber-and-trim-functions)
- [lodash regular expression denial of service in date handler](https://junglewise.ai/threats/cve-2019-1010266-lodash-regular-expression-denial-of-service-in-date-handler)