CVE-2026-4800

Fixed in a distro release EPSS 3%CVSS 8.1

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.

Published 2026-03-31 · CVE record · OSV

Products: lodash, lodash-es, lodash-amd, lodash.template, Red Hat Cryostat 4 on RHEL 9, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Data Grid 8.6.1, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Streams for Apache Kafka 2.9.4, Red Hat Streams for Apache Kafka 3.2.0, Red Hat Cluster Observability Operator 1.5.0, Red Hat Migration Toolkit for Virtualization 2.1, Red Hat Migration Toolkit for Virtualization 2.9, Red Hat Network Observability (NETOBSERV) 1.11.0, Red Hat Ansible Automation Platform 2.5, Red Hat Ansible Automation Platform 2.6, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Edge Manager 1.0, Red Hat Edge Manager 1.1, Red Hat Migration Toolkit 1.8, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15, Red Hat OpenShift Container Platform 4.16, Red Hat OpenShift Container Platform 4.17, Red Hat OpenShift Container Platform 4.18, Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift Container Platform 4.20, Red Hat OpenShift Container Platform 4.21, Red Hat OpenShift Container Platform 4.22, Red Hat Openshift Data Foundation 4.16, Red Hat Openshift Data Foundation 4.17, Red Hat Openshift Data Foundation 4.18, Red Hat Openshift Data Foundation 4.19, Red Hat Openshift Data Foundation 4.20, Red Hat OpenShift Dev Spaces 3.27, Red Hat OpenShift distributed tracing 3.9.3, Red Hat OpenShift GitOps 1.18, Red Hat OpenShift GitOps 1.19, Red Hat OpenShift Service Mesh 2.6, Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift Service Mesh 3.1, Red Hat OpenShift Service Mesh 3.2, Red Hat OpenShift Service Mesh 3.3, Red Hat Satellite 6.18, Red Hat Trusted Artifact Signer 1.3, Red Hat Confidential Compute Attestation, Red Hat Cryostat 4, Red Hat Gatekeeper 3, Logging Subsystem for Red Hat OpenShift, Red Hat Migration Toolkit for Applications 8, Red Hat Multicluster Engine for Kubernetes, Red Hat Node HealthCheck Operator, Red Hat OpenShift Lightspeed, Red Hat OpenShift Pipelines, Red Hat OpenShift Service Mesh 3, Red Hat 3scale API Management Platform 2, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Advanced Cluster Security 4, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, Red Hat Build of Keycloak, Red Hat Build of Podman Desktop, Red Hat Connectivity Link 1, Red Hat Developer Hub, Red Hat Directory Server 11, Red Hat Directory Server 12, Red Hat Directory Server 13, Red Hat Discovery 2, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Dev Spaces, Red Hat OpenShift GitOps, Red Hat OpenShift Virtualization 4, Red Hat Process Automation 7, Red Hat Quay 3, Red Hat Satellite 6, Red Hat Single Sign-On 7, Red Hat Trusted Artifact Signer, Red Hat Trusted Profile Analyzer, Red Hat Self-service automation portal 2

Fixed upstream

Distro releases