CVE-2026-4800

9.8Critical

Published 31 Mar 2026 · NVD status: Modified · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-94

Impact

Remote attackers can execute arbitrary code during template compilation without authentication. They need to supply untrusted key names to template import options or pollute Object.prototype via an existing vulnerability.

Root cause

The template compilation logic fails to validate key names in options.imports before passing them into a Function constructor, allowing expression injection and prototype-polluted keys to execute.

Affected systems

lodash, lodash-es, lodash-amd, and lodash.template prior to 4.18.1.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade lodash, lodash-es, lodash-amd, and lodash.template to version 4.18.1. If unable to patch immediately, ensure options.imports only uses hardcoded, developer-controlled static key names and never accepts untrusted input.

shell

$ npm install lodash@4.18.1

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-4800