npm/lodash-es CVE-2020-8203: high 7.4, EPSS 5.21%

Prototype Pollution in lodash

Action: Upgrade lodash-es to 4.17.20 or later.

npm i lodash-es@4.17.20

Affected

Fixed versions

Sources

• osv: GHSA-p6mc-m468-83gw#npm/lodash-es
• https://nvd.nist.gov/vuln/detail/CVE-2020-8203
• https://github.com/lodash/lodash/issues/4744
• https://github.com/lodash/lodash/issues/4874
• https://github.com/github/advisory-database/pull/2884
• https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12
• https://hackerone.com/reports/712065
• https://hackerone.com/reports/864701
• https://github.com/lodash/lodash
• https://github.com/lodash/lodash/wiki/Changelog#v41719
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml
• https://security.netapp.com/advisory/ntap-20200724-0006
• https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744

CVE-2020-8203 · published 2020-07-15T19:15:48Z · modified 2025-08-12T21:56:17.174859Z · JSON