VYPR
← All advisories
High severityNVD Advisory· Published Jul 15, 2020· Updated Aug 4, 2024

CVE-2020-8203

CVE-2020-8203

Description

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Prototype pollution in lodash's _.zipObjectDeep allows attackers to set arbitrary properties on Object.prototype, leading to potential remote code execution or denial of service.

Vulnerability

The _.zipObjectDeep function in lodash versions before 4.17.20 is vulnerable to prototype pollution [1]. Prototype pollution is a JavaScript vulnerability that allows an attacker to inject properties into an object's prototype chain, typically Object.prototype. If a maliciously crafted object is passed to _.zipObjectDeep, it can set arbitrary properties on the global prototype, affecting all objects in the application.

Exploitation

Exploitation requires the attacker to control the input passed to _.zipObjectDeep. This is commonly achieved through user-supplied data that is later processed by this function without proper sanitization. No authentication is needed if the vulnerable function is exposed to untrusted input via web forms, APIs, or other data ingestion points. The specific vector involves creating a path that includes __proto__ or constructor.prototype to traverse and modify the prototype chain [2][3][4].

Impact

Successful exploitation allows the attacker to pollute the prototype chain, which can lead to a variety of severe consequences. These include denial of service (by overwriting critical object methods), property injection that may enable code execution, and in some contexts, privilege escalation or bypass of security checks. The real-world impact depends on how the application uses the polluted prototypes—many lodash-based applications are at risk of remote code execution if attackers can control the properties that are later accessed or used in dynamic code execution paths.

Mitigation

Lodash released a fix in version 4.17.20 [1]. Users should upgrade to this version or later. No workaround is available for earlier versions aside from patching the function or avoiding the use of _.zipObjectDeep with untrusted input. The vulnerability has been publicly documented and is referenced in NVD [2] and GitHub issues [3][4].

References
  1. Changelog
  2. NVD - CVE-2020-8203
  3. lodash/lodash
  4. lodash/lodash

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
lodashnpm
>= 3.7.0, < 4.17.194.17.19
lodash-esnpm
>= 3.7.0, < 4.17.204.17.20
lodash.picknpm
>= 4.0.0, <= 4.4.0—
lodash.setnpm
>= 3.7.0, <= 4.3.2—
lodash.setwithnpm
<= 4.3.2—
lodash.updatenpm
<= 4.10.2—
lodash.updatewithnpm
<= 4.10.2—
lodash-railsRubyGems
>= 3.7.0, < 4.17.194.17.19

Affected products

9

Patches

1
c84fe82760fb

fix(zipObjectDeep): prototype pollution (#4759)

https://github.com/lodash/lodashJakub MikulasJul 2, 2020via ghsa
commit
2 files changed · +37 −0
  • lodash.js+4 −0 modified
    @@ -3990,6 +3990,10 @@
         var key = toKey(path[index]),
             newValue = value;
 
+        if (key === '__proto__' || key === 'constructor' || key === 'prototype') {
+          return object;
+        }
+
         if (index != lastIndex) {
           var objValue = nested[key];
           newValue = customizer ? customizer(objValue, key, nested) : undefined;
  • test/test.js+33 −0 modified
    @@ -25799,6 +25799,39 @@
     });
   });
 
+  // zipObjectDeep prototype pollution
+  ['__proto__', 'constructor', 'prototype'].forEach(function (keyToTest) {
+    QUnit.test('zipObjectDeep is not setting ' + keyToTest + ' on global', function (assert) {
+      assert.expect(1);
+
+      _.zipObjectDeep([keyToTest + '.a'], ['newValue']);
+      // Can't access plain `a` as it's not defined and test fails
+      assert.notEqual(root['a'], 'newValue');
+    });
+
+    QUnit.test('zipObjectDeep is not overwriting ' + keyToTest + ' on vars', function (assert) {
+      assert.expect(3);
+
+      const b = 'oldValue'
+      _.zipObjectDeep([keyToTest + '.b'], ['newValue']);
+      assert.equal(b, 'oldValue');
+      assert.notEqual(root['b'], 'newValue');
+
+      // ensure nothing was created
+      assert.notOk(root['b']);
+    });
+
+    QUnit.test('zipObjectDeep is not overwriting global.' + keyToTest, function (assert) {
+      assert.expect(2);
+
+      _.zipObjectDeep([root + '.' + keyToTest + '.c'], ['newValue']);
+      assert.notEqual(root['c'], 'newValue');
+
+      // ensure nothing was created
+      assert.notOk(root['c']);
+    });
+  });
+
   /*--------------------------------------------------------------------------*/
 
   QUnit.module('lodash.zipWith');

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

17

News mentions

0

No linked articles in our index yet.