Is CVE-2026-4800 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4800 being exploited in the wild.

How severe is CVE-2026-4800?

High severity, with a CVSS score of 8.1, published 31 March 2026.

Is there a fix for CVE-2026-4800?

A patch was published on 2026-03-31: Fixed in version 4.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-4800 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4800?

Check whether you run Lodash-Amd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4800: Lodash code injection in _.template imports

CVE-2026-4800 · Severity: high · CVSS 8.1 · Published 2026-03-31

Lodash is a widely used JavaScript utility library that helps developers manage data and templates. A security flaw in its templating engine allows an attacker to execute unauthorized code on a server if the application passes untrusted data into specific template settings. This could lead to a full system compromise, data theft, or service disruption.

Technologies: Lodash-Amd. Vendors: Lodash.

Quick answers

Is CVE-2026-4800 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4800 being exploited in the wild.
How severe is CVE-2026-4800?: High severity, with a CVSS score of 8.1, published 31 March 2026.
Which products and versions are affected?: lodash lodash < 4.18.0.
Is there a fix for CVE-2026-4800?: A patch was published on 2026-03-31: Fixed in version 4.18.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-4800 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4800?: Check whether you run Lodash-Amd. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A code injection vulnerability exists in lodash's _.template function due to an incomplete fix for CVE-2021-23337. While validation was added for the 'variable' option, the 'options.imports' key names remain unvalidated and flow into a Function() constructor sink. An attacker can provide malicious key names containing default-parameter expressions to achieve arbitrary code execution during template compilation. Additionally, the use of assignInWith to merge imports allows for property injection if Object.prototype has been polluted. This is exploitable if an application passes user-controlled input as key names to the template engine.

Affected products

lodash lodash < 4.18.0

Timeline

2026-03-31: disclosed: Vulnerability disclosed and published by OpenJS Foundation and NVD.
2026-03-31: patched: Fixed in version 4.18.0.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.