CVE-2026-4800
lodash vulnerable to Code Injection via imports key names
Published Mar 31, 2026 · updated Oct 15, 2026 · lodash lodash
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 31, 2026 · NIST NVD
Detected
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Add
Oct 15, 2026 · NIST NVD
Updated
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Add
Affected
- cpe lodash/lodashversion unspecified
- cpe lodash/lodash-amdversion unspecified
- cpe lodash/lodash-esversion unspecified
- cpe lodash/lodash.templateversion unspecified
- vendor lodash lodashversion unspecified
- vendor lodash lodash-amdversion unspecified
- vendor lodash lodash-esversion unspecified
- vendor lodash lodash.templateversion unspecified
Sources
- CIRCL Vulnerability LookupVulnerability recordCVE-2026-4800
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key n
vulnerability.circl.lu - CVE.orgVulnerability recordCVE-2026-4800
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-4800
30-day exploitation probability 2.6%
first.org - NIST NVDVulnerability recordCVE-2026-4800
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key n
nvd.nist.gov