Read the docs

lodash

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9

Exploited now

lodash records in CISA KEV

No lodash vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Lodash 10 records MEDIUM Lodash-amd 2 records MEDIUM Lodash-es 2 records MEDIUM Lodash.template 1 record MEDIUM Lodash.unset 1 record LOW

Records

1 record in Lodash.template · all components

TI-2026-04185 CVE-2026-4800 · GHSA-r5fr-rjxr-66jc

lodash vulnerable to Code Injection via `_.template` imports key names

Priority MEDIUM 48

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02808 Published 2026-03-31 Partial fix · 4.18.1, 4.18.0 CWE-94
Open these records in search →