Junglewise Threat Intelligence

CVE-2026-4800: Lodash code injection in _.template imports

CVE-2026-4800 · Severity: high · CVSS 8.1 · Published 2026-03-31

Technologies: Lodash-Amd. Vendors: Lodash.

Executive brief

Lodash is a widely used JavaScript utility library that helps developers manage data and templates. A security flaw in its templating engine allows an attacker to execute unauthorized code on a server if the application passes untrusted data into specific template settings. This could lead to a full system compromise, data theft, or service disruption.

Technical details

A code injection vulnerability exists in lodash's _.template function due to an incomplete fix for CVE-2021-23337. While validation was added for the 'variable' option, the 'options.imports' key names remain unvalidated and flow into a Function() constructor sink. An attacker can provide malicious key names containing default-parameter expressions to achieve arbitrary code execution during template compilation. Additionally, the use of assignInWith to merge imports allows for property injection if Object.prototype has been polluted. This is exploitable if an application passes user-controlled input as key names to the template engine.

Affected products

  • lodash lodash < 4.18.0

Timeline

  • 2026-03-31: disclosed: Vulnerability disclosed and published by OpenJS Foundation and NVD.
  • 2026-03-31: patched: Fixed in version 4.18.0.

References

Related threats