lodash vulnerable to Code Injection via `_.template` imports key names

🗓️ 01 Apr 2026 23:51:12Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 183 Views

Lodash template allows code execution from untrusted imports keys; upgrade to 4.18.0; fix validates imports keys and uses assignWith.

Reporter	Title	Published	Views	Family All 294
ibm	Security Bulletin: Multiple Vulnerabilities in IBM Tivoli Netcool/OMNIbus_GUI	26 May 202614:03	–	ibm
ibm	Security Bulletin: Vulnerabilities in lodash, cryptography and axios might affect IBM Storage Defender Sentinel Anomaly Scan Engine.	26 Jun 202616:53	–	ibm
ibm	Security Bulletin: Langflow OSS affected by vulnerabilies in Lodash versions 4.17.23 and earlier	8 Jun 202618:38	–	ibm
ibm	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for April 2026	30 Apr 202611:49	–	ibm
ibm	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in lodash and lodash-es (CVE-2026-2950, CVE-2026-4800)	2 Jun 202611:19	–	ibm
ibm	Security Bulletin: IBM WinCollect Agent is vulnerable to using components with known vulnerabilities	6 Jul 202613:49	–	ibm
ibm	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	5 Jun 202610:12	–	ibm
ibm	Security Bulletin: Carbon Charts lodash-es Security Vulnerabilities	27 Apr 202607:10	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (May 2026)	14 May 202601:21	–	ibm
ibm	Security Bulletin: Multiple security vulnerabilities addressed with IBM Business Automation Workflow cumulative fixes June 2026	29 Jun 202610:18	–	ibm

Vulners

Node

lodash lodash.templateRange4.0.0–4.18.0npm

lodash lodash-amdRange4.0.0–4.17.23npm

lodash lodash-esRange4.0.0–4.17.23npm

lodash lodashRange4.0.0–4.17.23npm

Source	Link
github	www.github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-4800
github	www.github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
cna	www.cna.openjsf.org/security-advisories.html
github	www.github.com/advisories/GHSA-35jh-r3h4-6jhm
github	www.github.com/advisories/GHSA-r5fr-rjxr-66jc

01 Apr 2026 23:51Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.1 - 9.8

EPSS0.01735

SSVC