Skip to content

[GHSA-r5fr-rjxr-66jc] lodash vulnerable to Code Injection via _.template imports key names #7354

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
goro wants to merge 1 commit into
base: goro/advisory-improvement-7354
Choose a base branch
from
+10 −35
Open

[GHSA-r5fr-rjxr-66jc] lodash vulnerable to Code Injection via _.template imports key names #7354

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 10 additions & 35 deletions advisories/github-reviewed/2026/04/GHSA-r5fr-rjxr-66jc/GHSA-r5fr-rjxr-66jc.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r5fr-rjxr-66jc",
"modified": "2026-04-01T23:51:12Z",
"modified": "2026-04-01T23:51:13Z",
"published": "2026-04-01T23:51:12Z",
"aliases": [
"CVE-2026-4800"
],
"summary": "lodash vulnerable to Code Injection via `_.template` imports key names",
"details": "### Impact\n\nThe fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink.\n\nWhen an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`.\n\n### Patches\n\nUsers should upgrade to version 4.18.0.\n\nThe fix applies two changes:\n1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option)\n2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated\n\n### Workarounds\n\nDo not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.",
"details": "### Impact\n\nThe fix for [CVE-2021-23337](https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the `variable` option in `_.template` but did not apply the same validation to `options.imports` key names. Both paths flow into the same `Function()` constructor sink.\n\nWhen an application passes untrusted input as `options.imports` key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, `_.template` uses `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are copied into the imports object and passed to `Function()`.\n\n### Patches\n\nUsers should upgrade to version 4.17.21.\n\nThe fix applies two changes:\n1. Validate `importsKeys` against the existing `reForbiddenIdentifierChars` regex (same check already used for the `variable` option)\n2. Replace `assignInWith` with `assignWith` when merging imports, so only own properties are enumerated\n\n### Workarounds\n\nDo not pass untrusted input as key names in `options.imports`. Only use developer-controlled, static key names.",
"severity": [
{
"type": "CVSS_V3",
Expand All @@ -28,14 +28,11 @@
"introduced": "4.0.0"
},
{
"fixed": "4.18.0"
"fixed": "4.17.21"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.17.23"
}
]
},
{
"package": {
Expand All @@ -50,55 +47,33 @@
"introduced": "4.0.0"
},
{
"fixed": "4.18.0"
"fixed": "4.17.21"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.17.23"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "lodash-amd"
"name": "lodash.template"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
"introduced": "0"
},
{
"fixed": "4.18.0"
"fixed": "none"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 4.17.23"
"last_known_affected_version_range": "<= 4.5.0"
}
},
{
"package": {
"ecosystem": "npm",
"name": "lodash.template"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.18.0"
}
]
}
]
}
],
"references": [
Expand Down
Loading