PT-2026-29336 · Lodash+3 · Lodash+3
Bugbunny-Research
+7
·
Published
2021-05-06
·
Updated
2026-07-03
·
CVE-2026-4800
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
lodash versions prior to 4.18.0
Description
The software contains a flaw related to template compilation. Specifically, insufficient validation of key names within the
options.imports object used by the .template function can allow an attacker to inject default-parameter expressions, leading to arbitrary code execution. The issue arises because validation applied to the option variable is not extended to the options.imports key names. Furthermore, the use of assignInWith can introduce vulnerabilities if Object.prototype has been compromised, potentially copying polluted keys into the imports object and ultimately executing malicious code.Recommendations
Upgrade to version 4.18.0.
Do not pass untrusted input as key names in
options.imports. Only use developer-controlled, static key names.Exploit
Fix
Code Injection
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Rocky Linux
Ubuntu
Lodash