StackRadar

CVE-2020-8203

High

Advisory

Published 15 Jul 2020In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.4
base score, highest
EPSS
0.052
92nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
123
of 17,781 indexed, latest versions
Container images
120
deployed by those charts
Fix available
3 of 5
affected packages

Prototype Pollution in lodash

Carried by container images the latest versions of 123 of 17,781 indexed charts deploy, on 120 images.

Affected packageAffected versionsFixed inImages
lodashnpm3.10.0, 3.10.1, 4.17.2, 4.17.4+5 more4.17.1975
lodash.picknpm4.4.0no fix listed34
lodash.setnpm4.3.2no fix listed16
lodash-esnpm4.17.4, 4.17.154.17.2011
node-lodashdeb4.17.15+dfsg-24.17.15+dfsg-2ubuntu0.1~esm12
OSV records
GHSA-p6mc-m468-83gwUBUNTU-CVE-2020-8203
Also known as
USN-8411-1

Charts affected

123 by stars
ChartLatestAffected imagesRadar Score
onos-progranopencord1.2.71 of 2See more

onos-progran opencord 1.2.7

1 of the 2 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
muluder/prograncontrollermcord:0.1.843b597a93da7
lodash@3.10.1
4.17.19

Open the chart page →

38,865
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
openwhisk/alarmprovider:2.2.0b695a6ceb406
lodash@3.10.1
4.17.19

Open the chart page →

36,215
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
lodash.pick@4.4.0
no fix listed

Open the chart page →

6,524
gristrlex0.1.01 of 1See more

grist rlex 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
gristlabs/grist:0.7.96e71b1914a7e
lodash@4.17.15
4.17.19

Open the chart page →

5,215
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
lodash.pick@4.4.0
no fix listed

Open the chart page →

4,684
hedgedocschmitzis0.1.121 of 1See more

hedgedoc schmitzis 0.1.12

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
lodash.pick@4.4.0
no fix listed

Open the chart page →

3,118
outlineschmitzis0.0.81 of 4See more

outline schmitzis 0.0.8

1 of the 4 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
outlinewiki/outline:0.69.1d060dcd8f9aa
lodash.pick@4.4.0
no fix listed

Open the chart page →

4,431
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
lodash@4.17.4
lodash.pick@4.4.0
4.17.19
no fix listed

Open the chart page →

3,638
parkingsikalabs0.1.01 of 1See more

parking sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
ondrejsika/parking:latestb1fd497416c8
lodash@4.17.15
4.17.19

Open the chart page →

3,696
logsmo-helm-chart6.0.01 of 6See more

log smo-helm-chart 6.0.0

1 of the 6 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
lodash@4.17.15
4.17.19

Open the chart page →

29,220
pombasmo-helm-chart6.0.01 of 17See more

pomba smo-helm-chart 6.0.0

1 of the 17 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
lodash@4.17.15
4.17.19

Open the chart page →

29,220
alertmanager-to-alerta-botsomeblackmagic0.2.01 of 1See more

alertmanager-to-alerta-bot someblackmagic 0.2.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
someblackmagic/alertmanager-to-alerta-bot:latest78bf43744ea5
lodash@4.17.15
4.17.19

Open the chart page →

2,121
alert-mappersomeblackmagic0.2.01 of 1See more

alert-mapper someblackmagic 0.2.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
someblackmagic/alert-mapper:v0.1.088351d85c04c
lodash@4.17.15
4.17.19

Open the chart page →

1,890
pachydermstatcan0.5.11 of 4See more

pachyderm statcan 0.5.1

1 of the 4 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
pachyderm/grpc-proxy:0.4.92b27f41d4d02
lodash@4.17.15
4.17.19

Open the chart page →

4,967
kurento_webrtc_demostunner0.1.01 of 2See more

kurento_webrtc_demo stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
lodash@3.10.1
4.17.19

Open the chart page →

12,460
stunner-kurento-one2one-callstunner0.1.01 of 2See more

stunner-kurento-one2one-call stunner 0.1.0

1 of the 2 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
lodash@3.10.1
4.17.19

Open the chart page →

12,460
grafanasvtech-public-helm-charts1.0.01 of 2See more

grafana svtech-public-helm-charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
svtechnmaa/svtech_grafana:v1.2.21d71314424aa
lodash@4.17.15
node-lodash@4.17.15+dfsg-2
4.17.19
4.17.15+dfsg-2ubuntu0.1~esm1

Open the chart page →

10,902
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
lodash@4.17.15
4.17.19

Open the chart page →

3,827
trudesktechpreta1.0.01 of 3See more

trudesk techpreta 1.0.0

1 of the 3 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
polonel/trudesk:1.2.60cf6513f6fe3
lodash@4.17.11
4.17.19

Open the chart page →

4,017
csmmth-chartsVerified publisher0.1.01 of 3See more

csmm th-charts 0.1.0

1 of the 3 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
catalysm/csmm:latestf003b35f54d9
lodash@3.10.1
4.17.19

Open the chart page →

3,576
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
lodash.pick@4.4.0
no fix listed

Open the chart page →

3,118
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
lodash-es@4.17.15
4.17.20

Open the chart page →

22,665
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2020-8203.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
lodash-es@4.17.15
lodash.pick@4.4.0
4.17.20
no fix listed

Open the chart page →

5,806

Container images carrying it

120 by charts deploying them

A fixed version is listed for 3 of the 5 affected packages.

Container imageDigestPackageFixed inUsed by
hyperledger/fabric-ca-tools:latest4ce6f43ded2e
lodash@3.10.1
4.17.19
4
hyperledger/fabric-couchdb:0.4.15f6c724592abf
lodash@3.10.1
4.17.19
4
pantsel/konga:latestc8172b75607d
lodash@3.10.1
4.17.19
3
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
lodash-es@4.17.15
lodash.pick@4.4.0
4.17.20
no fix listed
2
governify/director:v1.4.0608c6940bb98
lodash.set@4.3.2
no fix listed
2
governify/registry:v3.4.0d3f37f4f8168
lodash@3.10.1
lodash.set@4.3.2
4.17.19
no fix listed
2
governify/reporter:v2.2.038595913458f
lodash.set@4.3.2
no fix listed
2
l7mp/kurento-one2one-call-server:latestfd2b2d06fff6
lodash@3.10.1
4.17.19
2
library/ghost:6.63.0e05bc1169fb2
lodash.pick@4.4.0
no fix listed
2
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
lodash@4.17.15
lodash-es@4.17.15
lodash.set@4.3.2
4.17.19
4.17.20
no fix listed
2
migmartri/prerender:latest486aacfd5aa9
lodash@4.17.4
4.17.19
2
mojaloop/reporting:v12.1.0d480a62103d6
lodash@3.10.1
4.17.19
2
opensearchproject/opensearch-dashboards:1.0.039695180364b
lodash.pick@4.4.0
no fix listed
2
outlinewiki/outline:0.69.1d060dcd8f9aa
lodash.pick@4.4.0
no fix listed
2
statsd/statsd:v0.8.6dab129e74c25
lodash@4.17.15
4.17.19
2
taskrabbit/elasticsearch-dump:latestc967fe68b9c7
lodash@4.17.15
4.17.19
2
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
lodash.pick@4.4.0
no fix listed
2
amazon/opendistro-for-elasticsearch-kibana:1.4.05126e2e79a1f
lodash@4.17.15
lodash-es@4.17.15
4.17.19
4.17.20
1
amundsendev/amundsen-frontend:2.1.169e7915e61c1
lodash@4.17.15
4.17.19
1
apimap/developer:v1.3.1406d3858e20c
lodash.set@4.3.2
no fix listed
1
apimap/portal:v2.4.0041a4790c65c
lodash.set@4.3.2
no fix listed
1
archivebox/archivebox:0.7.41a5a37331091
lodash.pick@4.4.0
no fix listed
1
assistiot/cybersecurity-monitoring_id-kbn:latest2297b4350211
lodash-es@4.17.15
lodash.pick@4.4.0
4.17.20
no fix listed
1
assistiot/cybersecurity-monitoring_ir-kbn:latest0570b27bb7c2
lodash.pick@4.4.0
no fix listed
1
bastilimbach/docker-magicmirror:v2.15.041b0835ab31e
lodash@4.17.11
4.17.19
1
bicarus/mx-api-service:1.0.2-hf1dab88659ae3b
lodash.pick@4.4.0
no fix listed
1
billimek/node-influx-uptimerobot:latest5814f0bcf5ba
lodash@3.10.1
4.17.19
1
browserless/chrome:1.48.0-chrome-stablec81ae5585b47
lodash.set@4.3.2
no fix listed
1
catalysm/csmm:latestf003b35f54d9
lodash@3.10.1
4.17.19
1
conduction/conduction-ui-app:devd591f5e6f2a9
lodash@4.17.15
4.17.19
1
cryptexlabs/authf:0.12.11189c07411d7c
lodash@3.10.1
4.17.19
1
daskdev/dask-notebook:1.1.0052630f5ca04
lodash@4.17.11
4.17.19
1
datarhei/restreamer:0.6.4655e12f9eeed
lodash@4.17.15
4.17.19
1
decayofmind/hubot:3.3.21e18e92fe694
lodash@4.17.15
4.17.19
1
dessalines/lemmy-ui:0.19.20ee4c620d8e93
lodash@3.10.1
4.17.19
1
diygod/rsshub:2025-11-097a6312cac0d5
lodash.pick@4.4.0
no fix listed
1
ealen/picolors:0.1.03cb01dcbf652
lodash@4.17.15
4.17.19
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
lodash@4.17.4
4.17.19
1
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
lodash@3.10.1
4.17.19
1
fiware/idm:8.3.3a1b6ed4ae84f
lodash@4.17.4
4.17.19
1
flagsmith/flagsmith-frontend:v2.6.0df02a29e8b0c
lodash@4.17.15
4.17.19
1
galaxy/galaxy-init:v18.010267bad550e6
lodash@3.10.1
4.17.19
1
governify/collector-dynamic:v1.3.06d3d1a5b46a9
lodash.set@4.3.2
no fix listed
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
lodash@4.17.15
4.17.19
1
gristlabs/grist:0.7.96e71b1914a7e
lodash@4.17.15
4.17.19
1
halkeye/hubot:latest9764d2202130
lodash.pick@4.4.0
no fix listed
1
halkeye/irslackd:latest7638bfba70b0
lodash@4.17.15
4.17.19
1
hhaluk/crypto-watchdog:0.4.0a6555953d941
lodash.set@4.3.2
no fix listed
1
hyperledger/fabric-couchdb:0.4.10c65891b6c237
lodash@3.10.1
4.17.19
1
ianw/quickchart:v1.7.1dc49dd460c37
lodash.pick@4.4.0
no fix listed
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.