What is the CVSS score of CVE-2026-4800?

CVE-2026-4800 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Lodash are affected by CVE-2026-4800?

Lodash versions 4.0.0-4.17.x contain a code injection vulnerability in the template function enabling remote code execution when untrusted data reaches vulnerable code.. A patch is available.

Is there a public PoC exploit available for CVE-2026-4800?

Yes, a public proof-of-concept exploit is available for CVE-2026-4800. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-4800?

Within 24 hours: identify all systems and applications running Lodash versions 4.0.0-4.17.x. Within 7 days: upgrade to Lodash 4.18.0 or later, prioritizing business-critical systems. Within 30 days: complete testing and confirm all instances are patched.

Lodash CVE-2026-4800

EUVD-2026-17610 CRITICAL

Code Injection (CWE-94)

2026-03-31 openjs

GHSA-r5fr-rjxr-66jc

RCE Code Injection Lodash Lodash Es Lodash Amd Lodash Template

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

AC:H because exploitation needs the uncommon pattern of untrusted input as imports key names (or pre-existing prototype pollution); PR:N/UI:N as no attacker auth or victim interaction is required, and full RCE yields C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Red Hat

8.1 HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 03:54 vuln.today

v5 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 03:51 vuln.today

Analysis Updated

Jun 30, 2026 - 03:51 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 03:50 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 03:50 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

Severity Changed

Jun 30, 2026 - 03:24 NVD

HIGH CRITICAL

CVSS changed

Jun 30, 2026 - 03:24 NVD

8.1 (HIGH) 9.8 (CRITICAL)

Patch released

Apr 02, 2026 - 14:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 19:47 euvd

EUVD-2026-17610

Analysis Generated

Mar 31, 2026 - 19:47 vuln.today

CVE Published

Mar 31, 2026 - 19:25 nvd

HIGH 8.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

224 npm packages depend on lodash (119 direct, 110 indirect)
4,319 npm packages depend on lodash-es (1,069 direct, 3,333 indirect)
38 npm packages depend on lodash-template (13 direct, 25 indirect)
257 npm packages depend on lodash.template (82 direct, 176 indirect)

Ecosystem-wide dependent count for version 4.0.0 and other introduced versions.

DescriptionNVD

Impact:

The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.

When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.

Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

Patches:

Users should upgrade to version 4.18.0.

Workarounds:

Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.

AnalysisAI

Server-side code injection in Lodash's _.template function (lodash, lodash-es, lodash-amd and lodash.template, versions 4.0.0 to <4.18.0) lets an attacker execute arbitrary JavaScript at template-compilation time when an application passes untrusted input as options.imports key names. This is an incomplete-fix follow-on to CVE-2021-23337/GHSA-35jh-r3h4-6jhm: the original patch validated the variable option but left the imports key path flowing unchecked into the same Function() sink, and assignInWith's for..in merge also pulls in any prototype-polluted keys. Publicly available exploit code exists, but EPSS is only 0.07% (21st percentile) and CISA SSVC rates exploitation as none, reflecting that the dangerous pattern is uncommon in real deployments.