Vulnerability advisory

GHSA-p6mc-m468-83gw

Prototype Pollution in lodash

Published Jul 15, 2020Updated Aug 12, 2025OSV record ↗

Also known as CVE-2020-8203

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected versions

lodash npm

All lodash advisories →

Affected	Fixed in
`3.7.0` to before 4.17.19	`4.17.19`Advisories →

lodash-es npm

All lodash-es advisories →

Affected	Fixed in
`3.7.0` to before 4.17.20	`4.17.20`Advisories →

lodash.pick npm

All lodash.pick advisories →

Affected	Fixed in
`4.0.0` through `4.4.0`	No fix listed

lodash.set npm

All lodash.set advisories →

Affected	Fixed in
`3.7.0` through `4.3.2`	No fix listed

lodash.setwith npm

All lodash.setwith advisories →

Affected	Fixed in
All versions through `4.3.2`	No fix listed

lodash.update npm

All lodash.update advisories →

Affected	Fixed in
All versions through `4.10.2`	No fix listed

lodash.updatewith npm

All lodash.updatewith advisories →

Affected	Fixed in
All versions through `4.10.2`	No fix listed

lodash-rails RubyGems

All lodash-rails advisories →

Affected	Fixed in
`3.7.0` to before 4.17.19	`4.17.19`Advisories →
Also listed as affected (24) `3.10.0` `3.10.1` `3.7.0` `3.9.3` `4.0.0` `4.11.2` `4.12.0` `4.13.1` `4.14.1` `4.15.0` `4.16.1` `4.16.3` `4.16.4` `4.16.6` `4.17.10` `4.17.11` `4.17.14` `4.17.15` `4.17.2` `4.17.4` `4.17.5` `4.3.0` `4.5.1` `4.6.1`

Description

Versions of lodash prior to 4.17.19 are vulnerable to Prototype Pollution. The functions pick, set, setWith, update, updateWith, and zipObjectDeep allow a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires manipulating objects based on user-provided property values or arrays.

This vulnerability causes the addition or modification of an existing property that will exist on all objects and may lead to Denial of Service or Code Execution under specific circumstances.