{"id":"CVE-2026-4800","aliases":["CVE-2021-23337","GHSA-35jh-r3h4-6jhm","GHSA-r5fr-rjxr-66jc"],"url":"https://o3.security/vulnerability/CVE-2026-4800","summary":"lodash vulnerable to Code Injection via `_.template` imports key names","details":"Impact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().\n\nPatches:\n\nUsers should upgrade to version 4.18.0.\n\nWorkarounds:\n\nDo not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.","published":"2026-03-31T19:25:55.987Z","modified":"2026-09-15T03:31:00.272950880Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"score":0.02759,"percentile":0.85551,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"lodash","fixedVersion":"4.17.21"},{"ecosystem":"npm","name":"lodash-es","fixedVersion":"4.17.21"},{"ecosystem":"npm","name":"lodash.template","fixedVersion":null},{"ecosystem":"npm","name":"lodash-template","fixedVersion":null},{"ecosystem":"RubyGems","name":"lodash-rails","fixedVersion":"4.17.21"}],"fix":{"url":"https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","label":"lodash/lodash@3469357"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHBA-2026:21387"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10131"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10175"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10710"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10713"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11454"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11469"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11470"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11471"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11493"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11494"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11495"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11516"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12277"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12279"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13545"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13553"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13571"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13826"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14870"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14871"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17448"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17468"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17469"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17547"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17549"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17550"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17598"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17789"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19008"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19167"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19409"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19410"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20041"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20042"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20943"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20946"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21658"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22619"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24331"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34100"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34608"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36621"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37186"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40118"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40945"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40984"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41941"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41944"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42078"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44235"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48699"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:54188"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56789"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56854"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:56912"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:59833"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:60023"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8483"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8484"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8490"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8491"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8493"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8498"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9742"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-4800"},{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4800.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453496"},{"type":"FIX","url":"https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpuoct2021.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujul2022.html"},{"type":"WEB","url":"https://www.oracle.com/security-alerts/cpujan2022.html"},{"type":"WEB","url":"https://www.oracle.com//security-alerts/cpujul2021.html"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JS-LODASH-1040724"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930"},{"type":"WEB","url":"https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20210312-0006"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml"},{"type":"WEB","url":"https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851"},{"type":"PACKAGE","url":"https://github.com/lodash/lodash"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-15T03:31:00.272950880Z"}}