{"id":"CVE-2026-4800","aliases":["CVE-2021-23337","GHSA-35jh-r3h4-6jhm","GHSA-r5fr-rjxr-66jc"],"url":"https://o3.security/vulnerability/CVE-2026-4800","summary":"lodash vulnerable to Code Injection via `_.template` imports key names","details":"Impact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().\n\nPatches:\n\nUsers should upgrade to version 4.18.0.\n\nWorkarounds:\n\nDo not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.","published":"2026-03-31T19:25:55.987Z","modified":"2026-08-08T03:30:11.701906084Z","cvss":{"score":8.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"lodash","fixedVersion":"4.17.21"},{"ecosystem":"npm","name":"lodash-es","fixedVersion":"4.17.21"},{"ecosystem":"npm","name":"lodash.template","fixedVersion":null},{"ecosystem":"npm","name":"lodash-template","fixedVersion":null},{"ecosystem":"RubyGems","name":"lodash-rails","fixedVersion":"4.17.21"}],"fix":{"url":"https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","label":"lodash/lodash@3469357"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10131"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10175"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10710"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10713"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11454"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11469"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11470"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11471"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11493"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11494"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11495"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11516"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12277"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12279"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13545"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13553"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13571"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13826"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14870"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14871"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17448"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17468"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17469"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17547"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17549"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17550"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17598"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17789"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19008"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19167"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19409"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19410"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20041"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20042"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20943"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20946"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21658"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22619"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24331"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24762"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34100"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34342"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34608"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36621"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36651"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37186"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40118"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40795"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40945"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:40984"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41928"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41941"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:41944"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:42078"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:44235"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48699"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8483"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8484"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8490"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8491"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8493"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8498"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9742"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-4800"},{"type":"ADVISORY","url":"https://cna.openjsf.org/security-advisories.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/4xxx/CVE-2026-4800.json"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4800"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2453496"},{"type":"FIX","url":"https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:30:11.701906084Z"}}