From 75dc4846a314e95253c7a7313a5d95b1d3b46539 Mon Sep 17 00:00:00 2001
From: Goro Harumi <goro@goroharumi.com>
Date: Thu, 9 Apr 2026 13:28:55 -0700
Subject: [PATCH] Improve GHSA-r5fr-rjxr-66jc

---
 .../GHSA-r5fr-rjxr-66jc.json                  | 45 +++++--------------
 1 file changed, 10 insertions(+), 35 deletions(-)

diff --git a/advisories/github-reviewed/2026/04/GHSA-r5fr-rjxr-66jc/GHSA-r5fr-rjxr-66jc.json b/advisories/github-reviewed/2026/04/GHSA-r5fr-rjxr-66jc/GHSA-r5fr-rjxr-66jc.json
index e533662994350..8d6aa29a3fb88 100644
--- a/advisories/github-reviewed/2026/04/GHSA-r5fr-rjxr-66jc/GHSA-r5fr-rjxr-66jc.json
+++ b/advisories/github-reviewed/2026/04/GHSA-r5fr-rjxr-66jc/GHSA-r5fr-rjxr-66jc.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-r5fr-rjxr-66jc",
-  "modified": "2026-04-01T23:51:12Z",
+  "modified": "2026-04-01T23:51:13Z",
   "published": "2026-04-01T23:51:12Z",
   "aliases": [
     "CVE-2026-4800"
   ],
   "summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
-  "details": "### Impact\n\nThe fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink.\n\nWhen an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`.\n\n### Patches\n\nUsers should upgrade to version 4.18.0.\n\nThe fix applies two changes:\n1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option)\n2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated\n\n### Workarounds\n\nDo not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.",
+  "details": "### Impact\n\nThe fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink.\n\nWhen an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`.\n\n### Patches\n\nUsers should upgrade to version 4.17.21.\n\nThe fix applies two changes:\n1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option)\n2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated\n\n### Workarounds\n\nDo not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -28,14 +28,11 @@
               "introduced": "4.0.0"
             },
             {
-              "fixed": "4.18.0"
+              "fixed": "4.17.21"
             }
           ]
         }
-      ],
-      "database_specific": {
-        "last_known_affected_version_range": "<= 4.17.23"
-      }
+      ]
     },
     {
       "package": {
@@ -50,55 +47,33 @@
               "introduced": "4.0.0"
             },
             {
-              "fixed": "4.18.0"
+              "fixed": "4.17.21"
             }
           ]
         }
-      ],
-      "database_specific": {
-        "last_known_affected_version_range": "<= 4.17.23"
-      }
+      ]
     },
     {
       "package": {
         "ecosystem": "npm",
-        "name": "lodash-amd"
+        "name": "lodash.template"
       },
       "ranges": [
         {
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "4.0.0"
+              "introduced": "0"
             },
             {
-              "fixed": "4.18.0"
+              "fixed": "none"
             }
           ]
         }
       ],
       "database_specific": {
-        "last_known_affected_version_range": "<= 4.17.23"
+        "last_known_affected_version_range": "<= 4.5.0"
       }
-    },
-    {
-      "package": {
-        "ecosystem": "npm",
-        "name": "lodash.template"
-      },
-      "ranges": [
-        {
-          "type": "ECOSYSTEM",
-          "events": [
-            {
-              "introduced": "4.0.0"
-            },
-            {
-              "fixed": "4.18.0"
-            }
-          ]
-        }
-      ]
     }
   ],
   "references": [