CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names
Attackers can execute arbitrary code by injecting expressions into untrusted imports key names in lodash template compilation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-4800?
CVE-2026-4800 is a high-severity code injection vulnerability in lodash, published on 31 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.
Weakness: CWE-94
Which versions are affected by CVE-2026-4800?
8 open source packages ship an affected version, including lodash, lodash-amd and lodash-es. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
lodash npm | From 4.0.0 | 4.18.0 |
lodash npm | From 4.0.0 | 4.18.0 |
lodash-amd npm | From 4.0.0 | 4.18.0 |
lodash-amd npm | From 4.0.0 | 4.18.0 |
lodash-es npm | From 4.0.0 | 4.18.0 |
lodash-es npm | From 4.0.0 | 4.18.0 |
2 more packages
lodash.template npm | From 4.0.0 | 4.18.0 |
lodash.template npm | From 4.0.0 | 4.18.0 |
Linux distribution packages (32)
cockpit-ha-cluster AlmaLinux:10 | All versions | 0.12.1-1.el10_1.3 |
pcs AlmaLinux:9 | All versions | 0.11.10-1.el9_7.3 |
pcs AlmaLinux:9 | All versions | 0.11.11-2.el9_8.1 |
pcs-snmp AlmaLinux:9 | All versions | 0.11.10-1.el9_7.3 |
pcs-snmp AlmaLinux:9 | All versions | 0.11.11-2.el9_8.1 |
cockpit-ha-cluster Red Hat:enterprise_linux:10.1 | All versions | 0:0.12.1-1.el10_1.3 |
pcs Red Hat:enterprise_linux:10.1 | All versions | 0:0.12.1-1.el10_1.3 |
pcs-snmp Red Hat:enterprise_linux:10.1 | All versions | 0:0.12.1-1.el10_1.3 |
cockpit-ha-cluster Red Hat:enterprise_linux:10.2 | All versions | 0:0.12.2-3.el10_2.1 |
pcs Red Hat:enterprise_linux:10.2 | All versions | 0:0.12.2-3.el10_2.1 |
pcs-snmp Red Hat:enterprise_linux:10.2 | All versions | 0:0.12.2-3.el10_2.1 |
pcs Red Hat:enterprise_linux:9::highavailability | All versions | 0:0.11.10-1.el9_7.3 |
pcs Red Hat:enterprise_linux:9::highavailability | All versions | 0:0.11.11-2.el9_8.1 |
pcs-snmp Red Hat:enterprise_linux:9::highavailability | All versions | 0:0.11.10-1.el9_7.3 |
pcs-snmp Red Hat:enterprise_linux:9::highavailability | All versions | 0:0.11.11-2.el9_8.1 |
pcs Red Hat:enterprise_linux:9::resilientstorage | All versions | 0:0.11.10-1.el9_7.3 |
pcs Red Hat:enterprise_linux:9::resilientstorage | All versions | 0:0.11.11-2.el9_8.1 |
pcs-snmp Red Hat:enterprise_linux:9::resilientstorage | All versions | 0:0.11.10-1.el9_7.3 |
pcs-snmp Red Hat:enterprise_linux:9::resilientstorage | All versions | 0:0.11.11-2.el9_8.1 |
cockpit-ha-cluster Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.12.0-3.el10_0.5 |
pcs Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.12.0-3.el10_0.5 |
pcs-snmp Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.12.0-3.el10_0.5 |
pcs Red Hat:rhel_e4s:9.2::highavailability | All versions | 0:0.11.4-7.el9_2.8 |
pcs-snmp Red Hat:rhel_e4s:9.2::highavailability | All versions | 0:0.11.4-7.el9_2.8 |
pcs Red Hat:rhel_e4s:9.2::resilientstorage | All versions | 0:0.11.4-7.el9_2.8 |
pcs-snmp Red Hat:rhel_e4s:9.2::resilientstorage | All versions | 0:0.11.4-7.el9_2.8 |
pcs Red Hat:rhel_eus:9.4::highavailability | All versions | 0:0.11.7-2.el9_4.7 |
pcs-snmp Red Hat:rhel_eus:9.4::highavailability | All versions | 0:0.11.7-2.el9_4.7 |
pcs Red Hat:rhel_eus:9.4::resilientstorage | All versions | 0:0.11.7-2.el9_4.7 |
pcs-snmp Red Hat:rhel_eus:9.4::resilientstorage | All versions | 0:0.11.7-2.el9_4.7 |
pcs Red Hat:rhel_eus:9.6::highavailability | All versions | 0:0.11.9-2.el9_6.4 |
pcs-snmp Red Hat:rhel_eus:9.6::highavailability | All versions | 0:0.11.9-2.el9_6.4 |
Products include Lodash Lodash, Lodash Lodash-Amd, Lodash Lodash-Es, Lodash Lodash.template.
How do I fix CVE-2026-4800?
Upgrade lodash to 4.18.0 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-4800 being exploited?
There is no known exploitation of CVE-2026-4800 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in lodash
- CVE-2020-8203 Prototype Pollution in lodash
- CVE-2021-23337 Command Injection
- CVE-2025-13465 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
- CVE-2026-2950 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
- CVE-2019-1010266 Regular Expression Denial of Service (ReDoS) in lodash
Sources
Also known as ALSA-2026:10710, ALSA-2026:10713, ALSA-2026:19167, CLEANSTART-2026-HD42236, CLEANSTART-2026-SE20608, CLSA-2026-1778805969 and 54 more.