GHSA-r5fr-rjxr-66jc
High · 8.1CVSS
8.1
EPSS
—
Published
Apr 1, 2026
CISA due date
—
The record
lodash vulnerable to Code Injection via `_.template` imports key names
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | lodash | 4.0.0 | 4.18.0 |
| npm | lodash-amd | 4.0.0 | 4.18.0 |
| npm | lodash-es | 4.0.0 | 4.18.0 |
| npm | lodash.template | 4.0.0 | 4.18.0 |
| Chainguard | arangodb-3.11 | 0 | 3.11.14.3-r5 |
| Chainguard | argo-workflows-ui-3.7 | 0 | 3.7.13-r0 |
| Chainguard | argo-workflows-ui-4.0 | 0 | 4.0.4-r0 |
| Chainguard | code-server | 0 | 4.112.0-r2 |
| Chainguard | jitsucom-jitsu-console | 0 | 2.11.0-r19 |
| Chainguard | json-server | 0 | 0.17.4-r6 |
| Chainguard | kubeflow-pipelines-frontend | 0 | 2.16.0-r11 |
| Chainguard | langfuse-2 | 0 | 2.95.12-r17 |
| Chainguard | langfuse-2-worker | 0 | 2.95.12-r17 |
| Chainguard | langfuse-fips-2 | 0 | 2.95.12-r20 |
| Chainguard | langfuse-fips-2-worker | 0 | 2.95.12-r20 |
| Chainguard | npm | 0 | 11.12.1-r3 |
| Chainguard | opensearch-dashboards-3 | 0 | 3.5.0-r12 |
| Chainguard | opensearch-dashboards-3-fips | 0 | 3.5.0-r9 |
| Chainguard | renovate | 0 | 43.104.7-r1 |
| Chainguard | wazuh-dashboard | 0 | 4.14.4-r1 |
| Chainguard | wazuh-dashboard-alerting-dashboards-plugin | 0 | 4.14.4-r1 |
| Chainguard | wazuh-dashboard-anomaly-detection-dashboards-plugin | 0 | 4.14.4-r1 |
| Wolfi | argo-workflows-ui-3.7 | 0 | 3.7.13-r0 |
| Wolfi | argo-workflows-ui-4.0 | 0 | 4.0.4-r0 |
| Wolfi | code-server | 0 | 4.112.0-r2 |
| Wolfi | jitsucom-jitsu-console | 0 | 2.11.0-r19 |
| Wolfi | json-server | 0 | 0.17.4-r6 |
| Wolfi | kubeflow-pipelines-frontend | 0 | 2.16.0-r11 |
| Wolfi | npm | 0 | 11.12.1-r3 |
| Wolfi | opensearch-dashboards-3 | 0 | 3.5.0-r12 |
| Wolfi | renovate | 0 | 43.104.7-r1 |
Related vulnerabilities
- CVE-2026-4800 Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm)… Same vulnerability
- GHSA-f23m-r3pf-42rh lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit` Also affects lodash
- CVE-2026-2950 Impact: Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the… Also affects lodash
- GHSA-xxjr-mmjv-4gpg Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions Also affects lodash
- CVE-2025-13465 Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the… Also affects lodash
- CVE-2026-33228 flatted is a circular JSON parser. Also affects arangodb-3.11
- GHSA-rf6f-7fwh-wjgh Prototype Pollution via parse() in NodeJS flatted Also affects arangodb-3.11
- GHSA-25h7-pfq9-p65f flatted vulnerable to unbounded recursion DoS in parse() revive phase Also affects arangodb-3.11