CVE-2026-4800: lodash vulnerable to Code Injection via `_.template` imports key names
Description
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · CWE-94
Tracked companies
Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.
Status incidents that name it
- Wiz Some customers may see critical issues created from incorrectly classified vulnerability findings for CVE-2026-4800, CVE-2026-33937, CVE-2026-33938, and CVE-2026-33940· No impact listed · names this CVE
“Some customers may see critical issues created from incorrectly classified vulnerability findings for CVE-2026-4800, CVE-2026-33937, CVE-2026-33938, and CVE-2026-33940 This incident has been resolved. This incident has been resolved.…”
Affected vendors and products
lodash: lodashlodash: lodash-amdlodash: lodash-eslodash: lodash.templateRed Hat: Confidential Compute AttestationRed Hat: Cryostat 4Red Hat: Gatekeeper 3Red Hat: Logging Subsystem for Red Hat OpenShiftRed Hat: Red Hat Advanced Cluster Management for Kubernetes 2Red Hat: Red Hat Advanced Cluster Security 4Red Hat: Red Hat Ansible Automation Platform 2Red Hat: Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat: Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat: Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat: Red Hat build of Apache Camel - HawtIO 4Red Hat: Red Hat build of Apicurio Registry 3Red Hat: Red Hat Build of KeycloakRed Hat: Red Hat Connectivity Link 1Red Hat: Red Hat Data Grid 8.6.1Red Hat: Red Hat Directory Server 11Red Hat: Red Hat Directory Server 12Red Hat: Red Hat Directory Server 13Red Hat: Red Hat Discovery 2Red Hat: Red Hat Enterprise Linux 9Red Hat: Red Hat Enterprise Linux AI (RHEL AI) 3Red Hat: Red Hat Fuse 7Red Hat: Red Hat JBoss Enterprise Application Platform 7Red Hat: Red Hat JBoss Enterprise Application Platform 8Red Hat: Red Hat JBoss Enterprise Application Platform Expansion PackRed Hat: Red Hat OpenShift Virtualization 4Red Hat: Red Hat Process Automation 7Red Hat: Self-service automation portal 2Red Hat: Streams for Apache Kafka 2.9.4Red Hat: Streams for Apache Kafka 3.2.0
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- cna.openjsf.org/security-advisories.html (opens in new tab)
- github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)