CoreCVE
Back

CRITICAL

lodash vulnerable to Code Injection via `_.template` imports key names

Published Mar 31, 2026

Description

Impact:

The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.

When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.

Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

Patches:

Users should upgrade to version 4.18.0.

Workarounds:

Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.

Affected products

Remediation

Red Hat statement

In the context of Red Hat Enterprise Linux, the grafana and grafana-pcp packages execute the affected JavaScript entirely client-side within the user's browser. Consequently, the attack surface is strictly restricted to the local browser environment.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

Weaknesses (1)

CWE-94

Code Injection

References (85)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner openjs
Published Mar 31, 2026
Updated Sep 14, 2026
Reserved Mar 25, 2026
Link CVE-2026-4800
CISA Vulnrichment
Updated Mar 31, 2026
NVD
Status Modified
Modified Sep 10, 2026
Link CVE-2026-4800
Red Hat
Severity Important
Public date Mar 31, 2026
Links CVE-2026-4800 - Bugzilla
GHSA-R5FR-RJXR-66JC