Vulnerability details
CVE-2026-4800
Red Hat Confidential Compute AttestationRed Hat Cryostat 4Red Hat Logging Subsystem for Red Hat OpenShiftRed Hat Migration Toolkit for Applications 8Red Hat Node HealthCheck OperatorRed Hat OpenShift Lightspeed
lodash vulnerable to Code Injection via `_.template` imports key names
CVSS 3.1
8.1High
Official description
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (openjs) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Red Hat | Confidential Compute Attestation | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Cryostat 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Logging Subsystem for Red Hat OpenShift | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Migration Toolkit for Applications 8 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Node HealthCheck Operator | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Node HealthCheck Operator | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Pipelines | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat 3scale API Management Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Advanced Cluster Security 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Keycloak | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Podman Desktop | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Build of Podman Desktop | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Connectivity Link 1 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Developer Hub | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Discovery 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 10 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 8 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 8 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 8 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 8 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 9 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 9 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 9 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 9 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 9 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux 9 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Fuse 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Dev Spaces | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift GitOps | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Virtualization 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Process Automation 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Satellite 6 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Single Sign-On 7 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Trusted Profile Analyzer | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 2 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat build of Apicurio Registry 3 | All | CVEProject cvelistV5 (CNA) |
| Red Hat | Self-service automation portal 2 | All | CVEProject cvelistV5 (CNA) |
| lodash | lodash | 4.0.0 ≤ v < 4.18.1 | CVEProject cvelistV5 (CNA) |
| lodash | lodash-amd | 4.0.0 ≤ v < 4.18.1 | CVEProject cvelistV5 (CNA) |
| lodash | lodash-es | 4.0.0 ≤ v < 4.18.1 | CVEProject cvelistV5 (CNA) |
| lodash | lodash.template | 4.0.0 ≤ v < 4.18.1 | CVEProject cvelistV5 (CNA) |
References and advisories
80- https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
- https://cna.openjsf.org/security-advisories.html
- https://access.redhat.com/security/cve/CVE-2026-4800 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2453496 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:42078 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24762 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17789 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24331 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHBA-2026:21387 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34342 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11470 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10713 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19008 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11493 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11494 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11495 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11454 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11469 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11516 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:11471 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10710 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19167 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19409 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19410 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:16874 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13553 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13545 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22619 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9742 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13826 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36651 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40945 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40118 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41928 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24977 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:19712 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59833 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:54188 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56789 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56912 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56854 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36621 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34100 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60023 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17598 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:21658 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:48699 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17448 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20042 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44235 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20041 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17469 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40795 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17468 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37186 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:29795 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10175 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20946 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20943 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8483 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8484 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8490 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8491 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8493 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:9385 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17549 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17550 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41941 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:17547 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41944 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:12279 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:12277 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:40984 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14870 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:14871 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:8498 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:10131 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34608 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:13571 vendor-advisoryx_refsource_REDHAT
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-31
- Last updated
- 2026-10-15
- State
- Published
- Assigner (CNA)
- openjs
Exploit prediction (EPSS)
2.8%
Probability of exploitation in 30 days
86.5%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-94Improper Control of Generation of Code ('Code Injection')