VYPR
← All advisories
High severity8.1NVD Advisory· Published Mar 31, 2026· Updated May 1, 2026

CVE-2026-4800

CVE-2026-4800

Description

Impact:

The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.

When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.

Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

Patches:

Users should upgrade to version 4.18.0.

Workarounds:

Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
lodashnpm
>= 4.0.0, < 4.18.04.18.0
lodash-esnpm
>= 4.0.0, < 4.18.04.18.0
lodash-amdnpm
>= 4.0.0, < 4.18.04.18.0
lodash.templatenpm
>= 4.0.0, < 4.18.04.18.0

Affected products

137

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.