Skip to content
OpenAdvisories

Vendor

lodash

4 known vulnerabilities.

Products

lodash 4 lodash-es 3 lodash-amd 3 lodash.unset 2 lodash.omit 2 lodash.template 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-4800 Public exploit

    lodash vulnerable to Code Injection via `_.template` imports key names

    The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

    lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm