{"id":"CVE-2026-4800","summary":"lodash vulnerable to Code Injection via `_.template` imports key names","details":"Impact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().\n\nPatches:\n\nUsers should upgrade to version 4.18.0.\n\nWorkarounds:\n\nDo not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.","aliases":["CVE-2021-23337","GHSA-35jh-r3h4-6jhm","GHSA-r5fr-rjxr-66jc"],"modified":"2026-08-18T03:31:11.484317373Z","published":"2026-03-31T19:25:55.987Z","related":["ALSA-2026:10710","ALSA-2026:10713","ALSA-2026:19167","CGA-738g-g4gp-hqw4"],"database_specific":{"cna_assigner":"openjs","cwe_ids":["CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4800.json"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10131"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10175"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10710"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10713"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11454"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11469"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11470"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11471"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11493"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11494"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11495"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11516"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12277"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12279"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13545"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13553"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13571"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13826"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14870"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14871"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17448"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17468"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17469"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17547"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17549"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17550"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17598"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17789"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19008"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19167"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19409"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19410"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20041"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20042"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20943"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20946"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21658"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22619"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24331"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34100"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34608"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36621"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37186"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40118"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40945"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40984"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41941"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41944"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42078"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44235"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48699"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8483"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8484"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8490"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8491"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8493"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8498"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9742"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-4800"},{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4800.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453496"},{"type":"FIX","url":"https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lodash/lodash","events":[{"introduced":"d35a9c40beb594d09814ba7f7673b81d4d67a816"},{"fixed":"db27b6bb14b12a1451b20edf87dfe307b87a337d"},{"fixed":"3469357cff396a26c363f8c1b5a91dde28ba4b1c"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":["cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*","cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:*","cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:*"],"extracted_events":[{"introduced":"4.0.0"},{"fixed":"4.18.0"}]}}],"versions":["4.15.0-npm-packages","4.14.0-npm-packages","4.13.0-npm-packages","4.12.1-npm-packages","4.11.2-npm-packages","4.11.1-npm-packages","4.12.0-npm-packages","4.10.2-npm-packages","4.10.1-npm-packages","4.11.0-npm-packages","4.10.0-npm-packages","4.9.1-npm-packages","4.8.1-npm-packages","4.8.0-npm-packages","4.9.0-npm-packages","4.7.1-npm-packages","4.7.0-npm-packages","4.6.2-npm-packages","4.6.1-npm-packages","4.6.0-npm-packages","4.5.7-npm-packages","4.5.5-npm-packages","4.5.4-npm-packages","4.5.6-npm-packages","4.5.2-npm-packages","4.5.1-npm-packages","4.5.3-npm-packages","4.5.0-npm-packages","4.4.3-npm-packages","4.4.2-npm-packages","4.4.0-npm-packages","4.3.5-npm-packages","4.4.1-npm-packages","4.3.4-npm-packages","4.3.3-npm-packages","4.3.2-npm-packages","4.3.1-npm-packages","4.3.0-npm-packages","4.2.5-npm-packages","4.2.4-npm-packages","4.2.3-npm-packages","4.2.2-npm-packages","4.2.1-npm-packages","4.2.0-npm-packages","4.1.5-npm-packages","4.1.3-npm-packages","4.1.2-npm-packages","4.1.4-npm-packages","4.1.1-npm-packages","4.1.0-npm-packages","4.0.8-npm-packages","4.0.7-npm-packages","4.0.9-npm-packages","4.0.3-npm-packages","4.0.2-npm-packages","4.0.4-npm-packages","4.0.5-npm-packages","4.0.6-npm-packages","4.0.1-npm-packages","4.0.0-npm-packages"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-4800.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}