CVE-2026-4800: lodash vulnerable to Code Injection via `_.template` imports key names
Impact
The fix for CVE-2021-23337 added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.
When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.
Additionally, .template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
Patches
Users should upgrade to version 4.18.0.
The fix applies two changes: 1. Validate importsKeys against the existing reForbiddenIdentifierChars regex (same check already used for the variable option) 2. Replace assignInWith with assignWith when merging imports, so only own properties are enumerated
Workarounds
Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.
Other sources
Impact:
The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in .template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.
When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.
Additionally, .template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
Patches:
Users should upgrade to version 4.18.0.
Workarounds:
Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/lodash.templateto a version that resolves this vulnerability.Fixed in 4.18.0 - Upgrade
Upgrade
npm/lodash-amdto a version that resolves this vulnerability.Fixed in 4.18.0 - Upgrade
Upgrade
npm/lodash-esto a version that resolves this vulnerability.Fixed in 4.18.0 - Upgrade
Upgrade
npm/lodashto a version that resolves this vulnerability.Fixed in 4.18.0 - Upgrade
Upgrade
debian/node-lodashto a version that resolves this vulnerability.Fixed in 4.18.1+dfsg-3 - Upgrade
Upgrade
lodashto a version that resolves this vulnerability.Fixed in 4.18.0 - Configuration
Update lodash so that _.template validates options.imports key names (importsKeys) against the existing reForbiddenIdentifierChars regex; the CVE-2021-23337 fix only covered the variable option and needs the same validation for imports key names.
lodash _.template options.imports key names (importsKeys) = Validate importsKeys against the existing reForbiddenIdentifierChars regex (same check already used for the variable option) - Configuration
Replace assignInWith with assignWith when merging imports, so only own properties are enumerated (prevents inherited/polluted keys from being copied into the imports object that is later passed to Function() ).
lodash _.template imports merge implementation = Use assignWith instead of assignInWith when merging imports - Compensating control
Do not pass untrusted input as key names in options.imports.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4800?
CVE-2026-4800 is rated as a high severity vulnerability due to its potential for code injection.
How can I fix CVE-2026-4800?
To fix CVE-2026-4800, update lodash to version 4.18.1 or later, where the issue has been addressed.
What impact does CVE-2026-4800 have on my application?
CVE-2026-4800 allows attackers to execute arbitrary code within the context of the application that uses lodash's template function.
Which versions of lodash are affected by CVE-2026-4800?
Lodash versions before 4.18.1 are affected by CVE-2026-4800.
Is there a workaround for CVE-2026-4800?
There is no effective workaround for CVE-2026-4800 other than upgrading to a patched version of lodash.