Bug 2453496 (CVE-2026-4800)

Summary: CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aadhikar, aazores, abarbaro, abokovoy, abrianik, abuckta, akostadi, alcohan, alizardo, amasferr, amctagga, anjoseph, anpicker, anthomas, aoconnor, aschwart, asoldano, aszczucz, bbaranow, bbrownin, bdettelb, bmaxwell, bniver, boliveir, bparees, brasmith, bsmejkal, bstansbe, caswilli, cdrage, chfoley, cmah, cmyers, cochase, dbosanac, dhanak, dkuc, dlofthou, dmayorov, dnakabaa, doconnor, dranck, drichtar, drosa, dschmidt, dymurray, eaguilar, ebaron, eborisov, ehelms, erezende, ewittman, fdeutsch, flucifre, frenaud, ftrivino, ggainey, ggrzybek, gmalinko, gmeno, gotiwari, gparvin, groman, hasun, ibek, ibolton, istudens, ivassile, iweiss, jachapma, janstey, jbalunas, jchui, jfula, jgrulich, jhe, jhorak, jkoehler, jlanda, jlledo, jmatthew, jmontleo, jolong, jowilson, jprabhak, jraez, jreimann, jrokos, juwatts, jwong, kaycoth, kbempah, kshier, ktsao, lball, lchilton, lcouzens, lphiri, manissin, mbarnett, mbenjamin, mdessi, mhackett, mhess, mhulan, mnovotny, mosmerov, mposolda, mreynolds, mrizzi, mstipich, msvehla, mvyas, mwringe, nboldt, ngough, nipatil, nmoumoul, nwallace, nyancey, oaljalju, omaciel, ometelka, orabin, oramraz, osousa, pahickey, pantinor, parichar, pberan, pcattana, pcreech, pdelbell, pesilva, pgaikwad, pjindal, pmackay, progier, psrna, ptisnovs, rchan, rekumar, rexwhite, rgodfrey, rhaigner, rhel-process-autobot, rjohnson, rkubis, rmartinc, rstancel, rstepani, rushinde, sausingh, sdawley, sdoran, sfeifer, simaishi, slucidi, smaestri, smallamp, smcdonal, smullick, snegrini, solenoci, sostapov, spichugi, sseago, ssilvert, stcannon, sthirugn, sthorger, stirabos, swoodman, syedriko, tasato, tbordaz, teagle, thason, thjenkin, tmalecek, tpopela, tsedmik, ttakamiy, vashirov, vdosoudi, vereddy, veshanka, vle, vmuzikar, vvoronko, vwilson, watson-tool-maintainers, wtam, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in lodash. The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2453974, 2453976, 2453977, 2453978, 2453980, 2453981, 2453982, 2453987, 2453988, 2453989, 2453991, 2453992, 2453993, 2453995, 2453999, 2454004, 2454005, 2454006, 2454007, 2454008, 2454009, 2454010, 2454011, 2454012, 2454014, 2454015, 2454016, 2454019, 2454021, 2454022, 2454023, 2454024, 2454025, 2454026, 2454027, 2454028, 2454029, 2454031, 2454035, 2454039, 2454041, 2454046, 2454048, 2454049, 2454053, 2454054, 2454056, 2454057, 2453972, 2453973, 2453975, 2453979, 2453983, 2453984, 2453985, 2453986, 2453990, 2453994, 2453997, 2454001, 2454003, 2454013, 2454017, 2454018, 2454020, 2454033, 2454034, 2454036, 2454037, 2454038, 2454040, 2454042, 2454043, 2454044, 2454050, 2454051, 2454052, 2454055, 2454058    
Bug Blocks:    

Description OSIDB Bzimport 2026-03-31 20:01:47 UTC
Impact:

The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.

When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.

Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

Patches:

Users should upgrade to version 4.18.0.

Workarounds:

Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.

Comment 2 errata-xmlrpc 2026-04-27 01:30:52 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:10710 https://access.redhat.com/errata/RHSA-2026:10710

Comment 3 errata-xmlrpc 2026-04-27 01:34:54 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:10713 https://access.redhat.com/errata/RHSA-2026:10713

Comment 4 errata-xmlrpc 2026-04-29 05:25:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions

Via RHSA-2026:11454 https://access.redhat.com/errata/RHSA-2026:11454

Comment 5 errata-xmlrpc 2026-04-29 05:37:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:11470 https://access.redhat.com/errata/RHSA-2026:11470

Comment 6 errata-xmlrpc 2026-04-29 05:43:18 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:11471 https://access.redhat.com/errata/RHSA-2026:11471

Comment 7 errata-xmlrpc 2026-04-29 05:55:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.6 Telecommunications Update Service

Via RHSA-2026:11494 https://access.redhat.com/errata/RHSA-2026:11494

Comment 8 errata-xmlrpc 2026-04-29 05:56:52 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:11495 https://access.redhat.com/errata/RHSA-2026:11495

Comment 9 errata-xmlrpc 2026-04-29 05:56:56 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:11469 https://access.redhat.com/errata/RHSA-2026:11469

Comment 10 errata-xmlrpc 2026-04-29 06:15:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:11493 https://access.redhat.com/errata/RHSA-2026:11493

Comment 11 errata-xmlrpc 2026-04-29 07:39:19 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2026:11516 https://access.redhat.com/errata/RHSA-2026:11516

Comment 12 errata-xmlrpc 2026-05-04 23:37:55 UTC
This issue has been addressed in the following products:

  Streams for Apache Kafka 3.2.0

Via RHSA-2026:13571 https://access.redhat.com/errata/RHSA-2026:13571

Comment 13 errata-xmlrpc 2026-05-19 13:01:13 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19008 https://access.redhat.com/errata/RHSA-2026:19008

Comment 14 errata-xmlrpc 2026-05-19 17:58:33 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19167 https://access.redhat.com/errata/RHSA-2026:19167

Comment 15 errata-xmlrpc 2026-05-26 03:54:15 UTC
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:17789 https://access.redhat.com/errata/RHSA-2026:17789

Comment 17 errata-xmlrpc 2026-06-02 17:41:06 UTC
This issue has been addressed in the following products:

  Red Hat Data Grid 8.6.1

Via RHSA-2026:22619 https://access.redhat.com/errata/RHSA-2026:22619

Comment 18 errata-xmlrpc 2026-06-08 01:42:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:24331 https://access.redhat.com/errata/RHSA-2026:24331

Comment 19 errata-xmlrpc 2026-06-09 11:01:38 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:24762 https://access.redhat.com/errata/RHSA-2026:24762