Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVE-2020-8203
CVSS base score
7.4 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-770, CWE-1321
Last modified
November 2, 2026
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
lodash lodash
oracle banking corporate lending process management
oracle banking credit facilities process management
oracle banking extensibility workbench
oracle banking liquidity management
oracle banking supply chain finance
oracle banking trade finance process management
oracle banking virtual account management
oracle blockchain platform
oracle communications billing and revenue management
References
- github.com Issue Tracking, Vendor Advisory
- hackerone.com Exploit, Third Party Advisory
- security.netapp.com Third Party Advisory
- www.oracle.com Patch, Third Party Advisory
- www.oracle.com Patch, Third Party Advisory
- www.oracle.com Patch, Third Party Advisory
- www.oracle.com Patch, Third Party Advisory
- www.oracle.com Patch, Third Party Advisory
- github.com Issue Tracking, Vendor Advisory
- hackerone.com Exploit, Third Party Advisory