Lodash Code Injection via Template Options (CVE-2026-4800)

Vulnerability Explanation

CVE-2026-4800 is an incomplete-fix bypass of CVE-2021-23337. The 2021 patch added validation of the `variable` option in `_.template()` against the `reForbiddenIdentifierChars` regex, but the same validation was never applied to the key names of the `options.imports` object. Both code paths feed into the same `Function()` constructor sink. An attacker who controls `options.imports` key names can inject ES6 default-parameter expressions (e.g., `x=require('child_process').execSync(...)`) that execute synchronously at template compilation time — before any template rendering occurs. A second vector exists via prototype pollution: `_.template` used `assignInWith` to merge imports, which enumerates inherited properties via `for..in`. If `Object.prototype` has been polluted by any other vector, the polluted keys are automatically copied into the imports object and passed to `Function()`.

Root Cause

The `_.template` function constructs a JavaScript `Function()` dynamically using import key names as parameter identifiers. The 2021 fix (CVE-2021-23337) applied `reForbiddenIdentifierChars` validation only to the `variable` option, leaving `options.imports` key names unvalidated. Additionally, use of `assignInWith` (which walks the prototype chain via `for..in`) instead of `assignWith` (own-properties only) created a prototype pollution amplification path.

Technical Impact

Remote code execution (RCE) on the server or in the browser. An attacker who can influence `options.imports` key names can execute arbitrary JavaScript at template compilation time, enabling data exfiltration, server takeover, environment variable leakage, or lateral movement within the host environment. The attack requires no privileges and no user interaction once the vulnerable code path is reachable.

Severity Justification

CVSS 8.1 (High) per published scoring. Network-accessible RCE with no privileges required, but attack complexity is rated High due to the prerequisite that the application must pass attacker-controlled data as options.imports key names, or that a separate prototype pollution vector must already be present.

Affected Components

• lodash >= 4.0.0, < 4.18.0
• lodash-es >= 4.0.0, < 4.18.0
• lodash-amd >= 4.0.0, < 4.18.0
• lodash.template >= 4.0.0, < 4.18.0 (standalone package — see note)

Remediation Steps

1. Upgrade `lodash` to version 4.18.1 or higher. Note: 4.18.0 was the intended fix release but was deprecated due to a breaking change; use 4.18.1+. Run: `npm install lodash@latest` or `yarn add lodash@latest`.
2. Audit transitive dependencies: run `npm ls lodash` (or `yarn why lodash`) to identify any nested packages pinning an older version. Use `npm audit fix` or override the version in your `package.json` resolutions field.
3. If you use the standalone `lodash.template` npm package, be aware it has historically lagged behind the main package on security fixes. Migrate to the main `lodash` package or pin a patched version once available.
4. As a short-term workaround if upgrade is blocked: ensure `options.imports` key names are always static, developer-controlled identifiers — never derived from request parameters, database values, or any external input.
5. To mitigate the prototype pollution amplification vector in Node.js, add `Object.freeze(Object.prototype)` at application startup as a defence-in-depth measure.

Verification Steps

1. After upgrading, run `npm ls lodash` and confirm all resolved versions are >= 4.18.1.
2. Run `npm audit` and verify CVE-2026-4800 no longer appears in the output.
3. If you use Snyk or a similar SCA tool, re-scan the project and confirm SNYK-JS-LODASH-15869625 is resolved.
4. In a test environment, attempt to call `_.template('', { imports: { 'x=1': undefined } })` — the patched version should throw an error rather than compile successfully.

Code Examples (javascript)

// Vulnerable: user-controlled key name reaches _.template options.imports
const userKey = req.body.importName; // e.g. 'x=process.env'
const compiled = _.template('<%= x %>', {
  imports: { [userKey]: someValue }  // UNSAFE — key is not validated
});
compiled();

// Fixed: upgrade to lodash >= 4.18.1 (patch is in the library itself)
// Additionally, always use static, developer-controlled key names:
const compiled = _.template('<%= helper %>', {
  imports: { helper: myHelperFunction }  // SAFE — static key
});
compiled();

Best Practices

• Never pass user-supplied data as property key names in `_.template` options — treat import key names as code identifiers, not data.
• Maintain a software composition analysis (SCA) tool (e.g., `npm audit`, Snyk, Dependabot) in your CI pipeline to catch vulnerable transitive dependencies automatically.
• When a CVE is patched in a library, re-audit adjacent code paths in the same function for similar patterns — incomplete fixes are a documented recurring issue in lodash's `_.template`.
• Apply `Object.freeze(Object.prototype)` at Node.js application startup to prevent prototype pollution from amplifying injection vulnerabilities.

References

• github.com/advisories/GHSA-r5fr-rjxr-66jc
• nvd.nist.gov/vuln/detail/CVE-2026-4800
• security.snyk.io/vuln/SNYK-JS-LODASH-15869625
• advisories.gitlab.com/pkg/npm/lodash/CVE-2026-4800/
• github.com/advisories/GHSA-35jh-r3h4-6jhm