CVE-2026-4800: Lodash Template RCE Vulnerability

CVE-2026-4800 Overview

CVE-2026-4800 is a code injection vulnerability in the Lodash JavaScript utility library affecting the _.template function. The vulnerability exists because the fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink, allowing attackers to inject malicious code.

When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

Critical Impact
Remote attackers can achieve arbitrary code execution during template compilation by injecting malicious payloads through untrusted options.imports key names or via prototype pollution.

Affected Products

Lodash versions prior to 4.18.0

Discovery Timeline

2026-03-31 - CVE CVE-2026-4800 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-4800

Vulnerability Analysis

This vulnerability represents an incomplete fix for the previously disclosed CVE-2021-23337. While the earlier patch addressed command injection through the variable option in _.template, it failed to apply the same input validation to the options.imports key names. The core issue stems from both code paths ultimately feeding into JavaScript's Function() constructor, which dynamically compiles code from string inputs.

The vulnerability is classified as CWE-94 (Improper Control of Generation of Code - Code Injection). The attack requires network access and involves high complexity due to the prerequisite conditions, but requires no privileges or user interaction to exploit.

Root Cause

The root cause is insufficient input validation on the options.imports object key names in the _.template function. The original fix for CVE-2021-23337 focused solely on the variable option parameter, overlooking that options.imports keys also flow into the dangerous Function() constructor sink. Additionally, the use of assignInWith to merge imports introduces a secondary attack surface through prototype pollution, as it enumerates inherited properties via for..in loops.

Attack Vector

The attack can be executed remotely over the network. Attackers can exploit this vulnerability through two primary vectors:

Direct Injection: When applications accept user-controlled input for options.imports key names, attackers can inject default-parameter expressions that execute during template compilation.
Prototype Pollution Chain: If Object.prototype has been polluted through any other vulnerability in the application, the polluted keys are automatically copied into the imports object during the assignInWith operation and subsequently passed to Function().

javascript

 
   /** Error message constants. */
   var CORE_ERROR_TEXT = 'Unsupported core-js use. Try https://npms.io/search?q=ponyfill.',
-      FUNC_ERROR_TEXT = 'Expected a function';
+      FUNC_ERROR_TEXT = 'Expected a function',
+      INVALID_TEMPL_VAR_ERROR_TEXT = 'Invalid `variable` option passed into `_.template`';
 
   /** Used to stand-in for `undefined` hash values. */
   var HASH_UNDEFINED = '__lodash_hash_undefined__';

Source: Lodash Commit Changes

Detection Methods for CVE-2026-4800

Indicators of Compromise

Unusual or malformed key names in options.imports objects passed to _.template function calls
Unexpected code execution or process spawning originating from Node.js template compilation
Application logs showing template compilation errors with suspicious parameter expressions
Evidence of prototype pollution attempts in request bodies or query parameters

Detection Strategies

Implement static code analysis to identify _.template usage with dynamic options.imports key names
Deploy runtime application security monitoring to detect anomalous Function() constructor invocations
Use Software Composition Analysis (SCA) tools to identify vulnerable Lodash versions in dependencies
Monitor for prototype pollution patterns in incoming HTTP requests and JSON payloads

Monitoring Recommendations

Enable detailed logging for template compilation operations in Node.js applications
Implement Content Security Policy (CSP) with strict script-src directives to limit code execution
Deploy Web Application Firewall (WAF) rules to detect and block prototype pollution payloads
Monitor dependency management systems for alerts on vulnerable Lodash packages

How to Mitigate CVE-2026-4800

Immediate Actions Required

Upgrade Lodash to version 4.18.0 or later immediately
Audit codebase for all usages of _.template with dynamic options.imports parameters
Implement input validation to ensure only developer-controlled, static key names are used in options.imports
Review application for other prototype pollution vulnerabilities that could chain with this issue

Patch Information

Users should upgrade to Lodash version 4.18.0 which includes the security fix. The patch adds proper validation for options.imports key names, preventing injection of malicious expressions into the Function() constructor. For additional technical details, refer to the Lodash Commit Changes and the GitHub Security Advisory GHSA-35jh-r3h4-6jhm.

Workarounds

Do not pass untrusted input as key names in options.imports - only use developer-controlled, static key names
Implement Object freeze on Object.prototype to prevent prototype pollution chains
Use allowlist validation for any dynamic key names before passing to template functions
Consider using alternative templating libraries that do not use Function() constructor for compilation

bash

# Configuration example
# Update Lodash via npm
npm update lodash@4.18.0

# Or explicitly install the patched version
npm install lodash@4.18.0 --save

# Verify installed version
npm list lodash