npm/lodash-es CVE-2026-4800: high 8.1, EPSS 2.76%
lodash vulnerable to Code Injection via `_.template` imports key names
Action: Upgrade lodash-es to 4.18.0 or later.
npm i lodash-es@4.18.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.18.0 | - |
Fixed versions
| 4.18.0 |
Sources
- osv: GHSA-r5fr-rjxr-66jc#npm/lodash-es
- https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
- https://nvd.nist.gov/vuln/detail/CVE-2026-4800
- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
- https://cna.openjsf.org/security-advisories.html
- https://github.com/advisories/GHSA-35jh-r3h4-6jhm
- https://github.com/lodash/lodash
CVE-2026-4800 · published · modified · JSON