CVE-2026-4800: lodash Code Injection Vulnerability via `_.template` Imports
Summary
CVE-2026-4800: lodash vulnerable to Code Injection via _.template imports key names. Affects lodash versions >= 4.0.0, < 4.18.0. Fixed in 4.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lodash is a widely-used JavaScript utility library that provides modularity, performance, and extras for working with arrays, numbers, objects, strings, etc. It simplifies common programming tasks and enhances productivity. However, a recent vulnerability has been identified in the _.template function, which can lead to code injection if untrusted input is passed as key names in the options.imports parameter.
Vulnerability Detail
The vulnerability arises from insufficient validation of key names in the options.imports object passed to the _.template function. Although validation was added for the variable option in a previous fix (CVE-2021-23337), it did not extend to the imports key names. This oversight allows attackers to inject arbitrary code during template compilation by exploiting untrusted input. Additionally, the use of assignInWith to merge imports can lead to the inclusion of polluted properties from Object.prototype, further increasing the risk of code execution.
How To Fix
Latest published version: 4.18.1 as of 22 Oct 2026
npm install lodash@4.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.18.0
This is the first release that contains the fix.
npm install lodash@4.18.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Avoid passing untrusted input as key names in options.imports. Instead, use developer-controlled, static key names to mitigate the risk of code injection.
Conclusion
In summary, CVE-2026-4800 is a critical vulnerability in the lodash library that can lead to code injection if untrusted input is used in the _.template function. Users are advised to upgrade to version 4.18.0 or later to mitigate this risk. Additionally, using Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for lodash →
FAQ
CVE-2026-4800 is a vulnerability in the lodash library that allows for code injection through untrusted input in the _.template function's options.imports parameter.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
If upgrading is not possible, ensure that you do not pass untrusted input as key names in options.imports and use only static, developer-controlled key names.
Exploitation of this vulnerability can lead to arbitrary code execution during template compilation, potentially compromising the security of the application.
References
Related vulnerabilities
Recent vulnerabilities recorded for lodash.
