StackRadar

CVE-2020-8203

High

Advisory

Published 15 Jul 2020In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.052
92nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
123
of 17,781 indexed, latest versions
Container images
120
deployed by those charts
Fix available
3 of 5
affected packages

Prototype Pollution in lodash

Carried by container images the latest versions of 123 of 17,781 indexed charts deploy, on 120 images.

Affected packageAffected versionsFixed inImages
lodashnpm3.10.0, 3.10.1, 4.17.2, 4.17.4+5 more4.17.1975
lodash.picknpm4.4.0no fix listed34
lodash.setnpm4.3.2no fix listed16
lodash-esnpm4.17.4, 4.17.154.17.2011
node-lodashdeb4.17.15+dfsg-24.17.15+dfsg-2ubuntu0.1~esm12
OSV records
GHSA-p6mc-m468-83gwUBUNTU-CVE-2020-8203
Also known as
USN-8411-1

Charts affected

123 by stars
ChartLatestAffected imagesRadar Score
authfcryptexlabsVerified publisher0.12.131 of 4See more

authf cryptexlabs 0.12.13

1 of the 4 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
cryptexlabs/authf:0.12.11189c07411d7c
lodash@3.10.1
4.17.19

Open the chart page →

3,769
mergeabledoubanVerified publisher0.2.21 of 1See more

mergeable douban 0.2.2

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
ghcr.io/leoquote/mergeable:latest451706815103
lodash.set@4.3.2
no fix listed

Open the chart page →

4,223
amundsenduyet1.1.01 of 7See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
amundsendev/amundsen-frontend:2.1.169e7915e61c1
lodash@4.17.15
4.17.19

Open the chart page →

11,174
picolorsealenn0.1.01 of 1See more

picolors ealenn 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
ealen/picolors:0.1.03cb01dcbf652
lodash@4.17.15
4.17.19

Open the chart page →

576
hedgedocernail-hedgedoc5.0.01 of 1See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
lodash.pick@4.4.0
no fix listed

Open the chart page →

1,755
testnet-faucetethereum-helm-chartsVerified publisher0.1.31 of 1See more

testnet-faucet ethereum-helm-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
parithoshj/testnet-faucet:9859e0dcdca426fea6d
lodash@4.17.11
4.17.19

Open the chart page →

3,005
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
lodash@3.10.1
4.17.19

Open the chart page →

64,489
keyrockfiware0.8.71 of 1See more

keyrock fiware 0.8.7

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
fiware/idm:8.3.3a1b6ed4ae84f
lodash@4.17.4
4.17.19

Open the chart page →

3,159
wekan-oldgabisonfire0.1.21 of 1See more

wekan-old gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
wekanteam/wekan:v4.2268a51f0327df
lodash@3.10.0
lodash.pick@4.4.0
4.17.19
no fix listed

Open the chart page →

5,941
nightscoutgeek-cookbookVerified publisher1.2.21 of 1See more

nightscout geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
nightscout/cgm-remote-monitor:14.2.500c3b4833f1b
lodash@4.17.15
4.17.19

Open the chart page →

4,043
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
lodash.pick@4.4.0
no fix listed

Open the chart page →

9,019
Governify-Bluejaygovernify0.1.03 of 12See more

Governify-Bluejay governify 0.1.0

3 of the 12 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
governify/director:v1.4.0608c6940bb98
lodash.set@4.3.2
no fix listed
governify/registry:v3.4.0d3f37f4f8168
lodash@3.10.1
lodash.set@4.3.2
4.17.19
no fix listed
governify/reporter:v2.2.038595913458f
lodash.set@4.3.2
no fix listed

Open the chart page →

22,512
Governify-Falcongovernify0.1.04 of 10See more

Governify-Falcon governify 0.1.0

4 of the 10 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
governify/collector-dynamic:v1.3.06d3d1a5b46a9
lodash.set@4.3.2
no fix listed
governify/director:v1.4.0608c6940bb98
lodash.set@4.3.2
no fix listed
governify/registry:v3.4.0d3f37f4f8168
lodash@3.10.1
lodash.set@4.3.2
4.17.19
no fix listed
governify/reporter:v2.2.038595913458f
lodash.set@4.3.2
no fix listed

Open the chart page →

24,319
hubothalkeye0.0.11 of 1See more

hubot halkeye 0.0.1

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
halkeye/hubot:latest9764d2202130
lodash.pick@4.4.0
no fix listed

Open the chart page →

2,116
irslackdhalkeye0.1.01 of 1See more

irslackd halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
halkeye/irslackd:latest7638bfba70b0
lodash@4.17.15
4.17.19

Open the chart page →

2,064
matrix-appservice-gitterhalkeye0.1.01 of 1See more

matrix-appservice-gitter halkeye 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
lodash@3.10.1
4.17.19

Open the chart page →

3,003
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
lodash@4.17.15
lodash-es@4.17.15
4.17.19
4.17.20
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
lodash@4.17.15
lodash-es@4.17.15
4.17.19
4.17.20
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
lodash@4.17.13
lodash-es@4.17.15
4.17.19
4.17.20
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
lodash@4.17.15
lodash-es@4.17.15
4.17.19
4.17.20

Open the chart page →

89,959
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
lodash@4.17.15
lodash-es@4.17.15
lodash.set@4.3.2
4.17.19
4.17.20
no fix listed

Open the chart page →

8,213
archiveboxhelmforgeVerified publisher1.1.121 of 1See more

archivebox helmforge 1.1.12

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
archivebox/archivebox:0.7.41a5a37331091
lodash.pick@4.4.0
no fix listed

Open the chart page →

7,633
ghosthelmforgeVerified publisher1.2.61 of 3See more

ghost helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
library/ghost:6.62.0a7a268bbfb7f
lodash.pick@4.4.0
no fix listed

Open the chart page →

2,463
crypto-watchdoghuseyinnurbaki0.1.01 of 1See more

crypto-watchdog huseyinnurbaki 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
hhaluk/crypto-watchdog:0.4.0a6555953d941
lodash.set@4.3.2
no fix listed

Open the chart page →

2,656
ibm-app-navigatoribm-charts1.0.12 of 5See more

ibm-app-navigator ibm-charts 1.0.1

2 of the 5 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
ibmcom/app-nav-init:1.0.1240ff499eb5b
lodash@3.10.1
4.17.19
ibmcom/app-nav-ui:1.0.1e2a86997b36b
lodash@3.10.1
4.17.19

Open the chart page →

32,915
ibm-business-automation-insights-devibm-charts3.2.02 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

2 of the 6 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
ibmcom/bai-admin-dev:19.0.202d882f2836e
lodash@4.17.10
4.17.19
ibmcom/bai-setup-dev:19.0.2b8e8df11072d
lodash@4.17.10
4.17.19

Open the chart page →

39,349
ibm-microclimateibm-charts0.1.03 of 8See more

ibm-microclimate ibm-charts 0.1.0

3 of the 8 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
lodash@4.17.5
4.17.19
ibmcom/microclimate-portal:latested5505e5c7ec
lodash@4.17.5
4.17.19
ibmcom/microclimate-theia:lateste17bdccc5030
lodash@3.10.1
4.17.19

Open the chart page →

57,669
ibm-voice-gateway-devibm-charts3.1.01 of 2See more

ibm-voice-gateway-dev ibm-charts 3.1.0

1 of the 2 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
ibmcom/voice-gateway-mr:1.0.5.00762ab1df6c1
lodash@4.17.15
4.17.19

Open the chart page →

4,505
iframelyiframelyVerified publisher2.3.51 of 1See more

iframely iframely 2.3.5

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
lodash.pick@4.4.0
no fix listed

Open the chart page →

3,154
cloudshellinseefrlab4.3.01 of 2See more

cloudshell inseefrlab 4.3.0

1 of the 2 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
inseefrlab/shelly:cloudshell31f04ca7436b
lodash@4.17.15
4.17.19

Open the chart page →

10,494
interbtc-hydrainterlay0.1.151 of 4See more

interbtc-hydra interlay 0.1.15

1 of the 4 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
subsquid/hydra-indexer:5.0.0-alpha.37a7f8b9bad7ee
lodash.set@4.3.2
no fix listed

Open the chart page →

6,831
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
lodash@4.17.15
lodash-es@4.17.15
4.17.19
4.17.20

Open the chart page →

7,232
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
lodash.pick@4.4.0
no fix listed

Open the chart page →

3,436
monocularjenkins-x0.6.41 of 4See more

monocular jenkins-x 0.6.4

1 of the 4 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
lodash@4.17.4
4.17.19

Open the chart page →

4,614
yapijoelee2012Verified publisher0.2.01 of 1See more

yapi joelee2012 0.2.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
jayfong/yapi:1.10.2163e5d621910
lodash@4.17.15
4.17.19

Open the chart page →

6,454
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
lodash.pick@4.4.0
no fix listed

Open the chart page →

3,092
statsdkeyporttech0.1.191 of 1See more

statsd keyporttech 0.1.19

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
statsd/statsd:v0.8.6dab129e74c25
lodash@4.17.15
4.17.19

Open the chart page →

4,185
ohmyformkrzwiatrzyk0.0.11 of 1See more

ohmyform krzwiatrzyk 0.0.1

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
ohmyform/ohmyform:1.0.3afe53f4acdb1
lodash.pick@4.4.0
no fix listed

Open the chart page →

4,230
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
lodash.set@4.3.2
no fix listed

Open the chart page →

5,410
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
lodash.pick@4.4.0
no fix listed

Open the chart page →

2,756
nublado2lsst-sqre0.8.51 of 2See more

nublado2 lsst-sqre 0.8.5

1 of the 2 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
lsstsqre/nublado2:2.0.1b75bf8aaafa4
lodash@4.17.15
node-lodash@4.17.15+dfsg-2
4.17.19
4.17.15+dfsg-2ubuntu0.1~esm1

Open the chart page →

17,779
opendistro-eslsst-sqre1.4.11 of 3See more

opendistro-es lsst-sqre 1.4.1

1 of the 3 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
lodash@4.17.15
lodash-es@4.17.15
4.17.19
4.17.20

Open the chart page →

7,929
frontendluiscajl0.1.71 of 1See more

frontend luiscajl 0.1.7

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
lavandadelpatio/frontend:latest501c3f31e0bc
lodash@4.17.15
4.17.19

Open the chart page →

3,651
aws-api-gateway-operatormintel0.1.21 of 11See more

aws-api-gateway-operator mintel 0.1.2

1 of the 11 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
lodash.pick@4.4.0
no fix listed

Open the chart page →

10,603
standard-application-stackmintel11.4.01 of 12See more

standard-application-stack mintel 11.4.0

1 of the 12 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:1.0.039695180364b
lodash.pick@4.4.0
no fix listed

Open the chart page →

10,603
iotmmontesVerified publisher0.3.22 of 7See more

iot mmontes 0.3.2

2 of the 7 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
ghcr.io/mmontes11/iot-back:v3.11.096683c54ae65
lodash.set@4.3.2
no fix listed
ghcr.io/mmontes11/iot-biot:v3.11.033f7976b26a8
lodash.set@4.3.2
no fix listed

Open the chart page →

10,608
finance-portalmojaloop5.1.41 of 11See more

finance-portal mojaloop 5.1.4

1 of the 11 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
mojaloop/reporting:v12.1.0d480a62103d6
lodash@3.10.1
4.17.19

Open the chart page →

14,809
reporting-legacy-apimojaloop2.2.01 of 1See more

reporting-legacy-api mojaloop 2.2.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
mojaloop/reporting:v12.1.0d480a62103d6
lodash@3.10.1
4.17.19

Open the chart page →

1,948
monocularmonocular1.4.152 of 5See more

monocular monocular 1.4.15

2 of the 5 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
migmartri/prerender:latest486aacfd5aa9
lodash@4.17.4
4.17.19
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
lodash@3.10.1
4.17.19

Open the chart page →

7,048
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
lodash.pick@4.4.0
no fix listed

Open the chart page →

4,960
smilencsaVerified publisher1.1.01 of 23See more

smile ncsa 1.1.0

1 of the 23 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
lodash@3.10.1
4.17.19

Open the chart page →

109,294
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
linuxserver/codimd:latestb801bbcf6386
lodash.pick@4.4.0
no fix listed

Open the chart page →

27,465
comacopencord1.0.01 of 9See more

comac opencord 1.0.0

1 of the 9 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
omecproject/onos-progran:1.0.05715e5648aa0
lodash@3.10.1
4.17.19

Open the chart page →

88,546

Container images carrying it

120 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
vabene1111/recipes:1.0.5.2ec4e9e2905b0
lodash.pick@4.4.0
no fix listed
1
wekanteam/wekan:v4.2268a51f0327df
lodash@3.10.0
lodash.pick@4.4.0
4.17.19
no fix listed
1
willwill/kube-slack:v4.1.1d443017aae98
lodash@4.17.11
lodash.pick@4.4.0
4.17.19
no fix listed
1
wiremind/scrapoxy:lateste7048929a676
lodash@4.17.15
4.17.19
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
lodash@4.17.15
lodash-es@4.17.15
4.17.19
4.17.20
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
lodash@4.17.15
lodash-es@4.17.15
4.17.19
4.17.20
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
lodash@4.17.13
lodash-es@4.17.15
4.17.19
4.17.20
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
lodash@4.17.15
lodash-es@4.17.15
4.17.19
4.17.20
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
lodash.pick@4.4.0
no fix listed
1
ghcr.io/leoquote/mergeable:latest451706815103
lodash.set@4.3.2
no fix listed
1
ghcr.io/mmontes11/iot-back:v3.11.096683c54ae65
lodash.set@4.3.2
no fix listed
1
ghcr.io/mmontes11/iot-biot:v3.11.033f7976b26a8
lodash.set@4.3.2
no fix listed
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
lodash.pick@4.4.0
no fix listed
1
quay.io/hedgedoc/hedgedoc:1.10.8abdb6b08815d
lodash.pick@4.4.0
no fix listed
1
quay.io/helmpack/monocular-ui:v1.10.086b71e90319f
lodash@3.10.1
4.17.19
1
quay.io/ibmgaragecloud/developer-dashboard:v1.4.47a4b9fedc724
lodash@4.17.15
4.17.19
1
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
lodash@4.17.15
4.17.19
1
quay.io/wekan/wekan:v5.65cb17600883a3
lodash@4.17.4
lodash.pick@4.4.0
4.17.19
no fix listed
1
registry.gitlab.com/infinitydon/registry/open5gs-webui:v2.2.2fda21b0a0344
lodash@4.17.10
lodash-es@4.17.4
4.17.19
4.17.20
1
registry.gitlab.com/xrow-public/helm-iframely/iframely:2.3.5fcf07d5ff7e2
lodash.pick@4.4.0
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.