Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2026-4800 Details

Description

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:9.8 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA: redhat-SADPCVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://access.redhat.com/errata/RHBA-2026:21387 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10131 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10175 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10710 redhat-SADP
https://access.redhat.com/errata/RHSA-2026:10713 redhat-SADP

see all 80 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-94Improper Control of Generation of Code ('Code Injection')redhat-SADP
CWE-94Improper Control of Generation of Code ('Code Injection')openjs

Affected Products

ProductVersions
lodash lodash
>= 4.0.0, < 4.18.0

CPE

  • cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*

Remediation

  • No remediation found in references.
lodash lodash-amd
>= 4.0.0, < 4.18.0

CPE

  • cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:*

Remediation

  • No remediation found in references.
lodash lodash-es
>= 4.0.0, < 4.18.0

CPE

  • cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:*

Remediation

  • No remediation found in references.
lodash lodash.template
>= 4.0.0, < 4.18.0

CPE

  • cpe:2.3:a:lodash:lodash.template:*:*:*:*:*:node.js:*:*

Remediation

  • No remediation found in references.

Change History

43 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2026-4800
NVD Published Date:
Mar 31, 2026
NVD Last Modified:
Oct 15, 2026
Source:
openjs
CVE-2026-4800 Details - Not Deferred