Description
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lodash | lodash | 4.0.0 – < 4.18.1 | 4.18.1 |
| lodash | lodash-es | 4.0.0 – < 4.18.1 | 4.18.1 |
| lodash | lodash-amd | 4.0.0 – < 4.18.1 | 4.18.1 |
| lodash | lodash.template | 4.0.0 – < 4.18.1 | 4.18.1 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-lodash | 4.18.1+dfsg-1 | — |
| Debian 13 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 | — |
| Debian 12 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-lodash | No fix yet | — |
| Ubuntu 25.10 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 | USN-8411-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-lodash | 4.17.23+dfsg-1ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 24.04 LTS | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | USN-8411-1 |
| Ubuntu Pro 22.04 LTS | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 20.04 LTS | node-lodash | 4.17.15+dfsg-2ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 18.04 LTS | node-lodash | 4.17.4+dfsg-1ubuntu0.1~esm1 | USN-8411-1 |
| Ubuntu Pro 16.04 LTS | node-lodash | 2.4.1+dfsg-3ubuntu0.1~esm1 | USN-8411-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | cockpit +7 | 356.1-1.el10_2 | RHBA-2026:21388 |
| RHEL 10 | cockpit-image-builder | 94.3-1.el10_2 | RHSA-2026:24331 |
| RHEL 10 | pcs +2 | 0.12.1-1.el10_1.3 | RHSA-2026:19008, RHSA-2026:10713 |
| RHEL 9 | cockpit +7 | 356.1-1.el9_8 | RHBA-2026:21387 |
| RHEL 9 | pcs +1 | 0.11.10-1.el9_7.3 | RHSA-2026:19167, RHSA-2026:10710 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | pcs +2 | 0.12.0-3.el10_0.5 | RHSA-2026:11470 |
| RHEL 9.6 EUS | pcs +1 | 0.11.9-2.el9_6.4 | RHSA-2026:11471 |
| RHEL 9.4 EUS | pcs +1 | 0.11.7-2.el9_4.7 | RHSA-2026:11516 |
| RHEL 9.2 E4S | pcs +1 | 0.11.4-7.el9_2.8 | RHSA-2026:11469 |
| RHEL 9.0 E4S | pcs +1 | 0.11.1-10.el9_0.11 | RHSA-2026:11454 |
| RHEL 8.8 TUS | pcs +1 | 0.10.15-4.el8_8.11 | RHSA-2026:11495 |
| RHEL 8.8 E4S | pcs +1 | 0.10.15-4.el8_8.11 | RHSA-2026:11495 |
| RHEL 8.6 TUS | pcs +1 | 0.10.12-6.el8_6.13 | RHSA-2026:11494 |
| RHEL 8.6 E4S | pcs +1 | 0.10.12-6.el8_6.13 | RHSA-2026:11494 |
| RHEL 8.4 EUS Long Life | pcs +1 | 0.10.8-1.el8_4.11 | RHSA-2026:11493 |
| RHEL 8.4 AUS | pcs +1 | 0.10.8-1.el8_4.11 | RHSA-2026:11493 |
| Red Hat Ansible Automation Platform Inside 2 | ansible-core | 1:2.16.19-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-click | 8.3.3-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Inside 2 | python3.12-cryptography | 46.0.7-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.6.5-1.el9ap | RHSA-2026:42078, RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | ansible-core | 1:2.16.19-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.6.30-2.el8ap | RHSA-2026:42078, RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3-click | 8.3.3-1.el10ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-click | 8.3.3-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-cryptography | 46.0.7-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-urllib3 | 2.7.0-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.6.5-1.el9ap | RHSA-2026:42078, RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | ansible-core +1 | 1:2.16.19-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.6.30-2.el8ap | RHSA-2026:42078, RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | automation-eda-controller +4 | 1.1.20-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-gateway +2 | 2.5.20260715-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy +1 | 2.6.14-3.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | automation-hub +1 | 4.10.16-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.9-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3-click | 8.3.3-1.el10ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3.12-click | 8.3.3-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3.12-cryptography | 46.0.7-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.50-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pillow | 12.2.0-1.el9ap | RHSA-2026:24762 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulp-ansible | 1:0.25.6-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulp-container | 2.19.12-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulpcore | 3.49.63-2.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.13.0-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pysequoia | 0.1.34-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-urllib3 | 2.7.0-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.6.5-1.el9ap | RHSA-2026:42078, RHSA-2026:24762 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.3 | ALSA-2026:10713 |
| AlmaLinux 9 | pcs +1 | 0.11.10-1.el9_7.3 | ALSA-2026:19167, ALSA-2026:10710 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | cockpit-files | 43-1.el10 | RLSA-2026:97194 |
| Rocky Linux 10 | cockpit-image-builder | 94.3-1.el10_2 | RLSA-2026:24331 |
| Rocky Linux 10 | cockpit-machines | 355-1.el10 | RLSA-2026:97238 |
| Rocky Linux 10 | cockpit-podman | 129-1.el10 | RLSA-2026:97193 |
| Rocky Linux 10 | rhsm-icons +1 | 17-1.el10.rocky.0.1 | RLSA-2026:97090 |
| Rocky Linux 9 | cockpit-files | 43-1.el9 | RLSA-2026:97538 |
| Rocky Linux 9 | cockpit-machines | 355-1.el9 | RLSA-2026:97539 |
| Rocky Linux 9 | cockpit-podman | 129-1.el9 | RLSA-2026:97537 |
| Rocky Linux 9 | pcs | 0.11.10-1.el9_7.3 | RLSA-2026:19167, RLSA-2026:10710 |
| Rocky Linux 9 | rhsm-icons +1 | 17-1.el9.rocky.0.1 | RLSA-2026:97514 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | cockpit-image-builder | 94.3-1.0.1.el10_2 | ELSA-2026-24331 |
| Oracle Linux 10 | pcs +2 | 0.12.1-1.el10_1.3 | ELSA-2026-19008, ELSA-2026-10713 |
| Oracle Linux 9 | pcs +1 | 0.11.10-1.el9_7.3 | ELSA-2026-19167, ELSA-2026-10710 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-workflows-ui-4.0 | 4.0.4-r0 | — |
| Wolfi rolling | code-server | 4.112.0-r2 | — |
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r19 | — |
| Wolfi rolling | json-server | 0.17.4-r6 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r18 | — |
| Wolfi rolling | kubeflow-pipelines-frontend | 2.16.0-r11 | — |
| Wolfi rolling | langfuse-3 +1 | 3.164.0-r1 | — |
| Wolfi rolling | npm | 11.12.1-r3 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.5.0-r12 | — |
| Wolfi rolling | opensearch-dashboards-3-dashboards-observability +3 | 3.5.0-r15 | — |
| Wolfi rolling | prism | 5.15.6-r2 | — |
| Wolfi rolling | py3.10-jupyterlab +3 | 4.6.1-r1 | — |
| Wolfi rolling | renovate | 43.104.7-r0 | — |
| Wolfi rolling | saf | 1.6.0-r0 | — |
| Wolfi rolling | sqlpad | 7.5.7-r17 | — |
| Wolfi rolling | superset-6.1 | 6.1.0-r25 | — |
| Wolfi rolling | ts-patch | 4.0.1-r3 | — |
| Wolfi rolling | vitess-23 | 23.0.3-r12 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 2 repositories
-
threalwinky/CVE-2026-4800-POC ★ 3 · Apr 1, 2026
-
SvenLie/next-rep-CVE-2026-4800 ★ 0 · Apr 7, 2026
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | lodash | >= 4.0.0, < 4.18.0 | 4.18.0 | GHSA-r5fr-rjxr-66jc |
| npm | lodash-amd | >= 4.0.0, < 4.18.0 | 4.18.0 | GHSA-r5fr-rjxr-66jc |
| npm | lodash-es | >= 4.0.0, < 4.18.0 | 4.18.0 | GHSA-r5fr-rjxr-66jc |
| npm | lodash.template | >= 4.0.0, < 4.18.0 | 4.18.0 | GHSA-r5fr-rjxr-66jc |
Advisories 50
- RLSA-2026:97194 Important: cockpit-files security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97538 Important: cockpit-files security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97514 Important: subscription-manager-cockpit security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97238 Important: cockpit-machines security, bug fix, and enhancement update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97537 Important: cockpit-podman security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97090 Important: subscription-manager-cockpit security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97193 Important: cockpit-podman security update Rocky Linux Security Advisories · Nov 13, 2026
- RLSA-2026:97539 Important: cockpit-machines security update Rocky Linux Security Advisories · Nov 13, 2026
- WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-1160 Red Hat Enterprise Linux und Satellite (satellite/iop-remediations-rhel9 container image): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- WID-SEC-2026-2933 Splunk SOAR: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:19167 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:10710 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:10713 Important: pcs security update AlmaLinux Security Advisories · Oct 29, 2026
- USN-8411-1 node-lodash vulnerabilities Ubuntu Security Notices (USN) · Oct 27, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- RHSA-2026:42078 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:24762 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHBA-2026:21387 Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHBA-2026:21388 Red Hat Bug Fix Advisory: cockpit bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:24331 Red Hat Security Advisory: cockpit-image-builder security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:19167 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:19008 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:11516 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:11495 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:11493 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:11494 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:11471 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:11469 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:11470 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:11454 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:10713 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:10710 Red Hat Security Advisory: pcs security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- WID-SEC-2026-2460 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- VDE-2026-088 METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4 CERT@VDE · Sep 10, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026
- NCSC-2026-0309 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Aug 19, 2026
- WID-SEC-2026-2887 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 18, 2026
- NCSC-2026-0258 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jul 22, 2026
- NCSC-2026-0256 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Jul 22, 2026
- WID-SEC-2026-2448 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-2445 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-2436 Oracle Construction and Engineering: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- ELSA-2026-19008 Important: pcs security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- ELSA-2026-24331 Important: cockpit-image-builder security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 16, 2026
- WID-SEC-2026-2260 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 8, 2026
- WID-SEC-2026-1654 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2026