Loading vulnerability…
CVE-2026-4800 is an arbitrary code execution vulnerability in Lodash's _.template functionality caused by incomplete input validation in a prior fix for CVE-2021-23337. The earlier remediation validated the variable option but did not apply equivalent validation to key names supplied through options.imports, even though both data paths are incorporated into the same Function() constructor sink during template compilation. If an application allows attacker-controlled values to be used as options.imports key names, those keys can be crafted as default-parameter expressions and injected into the generated function body, resulting in code execution when the template is compiled. The issue is further compounded by the use of assignInWith to merge imports, because inherited properties are enumerated via for..in; if Object.prototype has already been polluted through another vector, inherited polluted keys can be copied into the imports object and then passed into the Function() constructor path.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
options.imports for _.template. Restrict import names to static, developer-controlled identifiers. As a defense-in-depth measure, prevent and remediate prototype pollution elsewhere in the application and avoid patterns that allow attacker influence over objects later consumed by template compilation.Patch, then assume compromise.
_.template import key names against the same forbidden-identifier-character checks used for the variable option and changes import merging behavior to avoid inheriting polluted properties during the merge path.1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a small JavaScript proof-of-concept for CVE-2026-4800 affecting lodash template handling. It contains two executable PoC files under POCs/, a minimal package.json/package-lock.json pinning lodash 4.17.23, and a README that explains the vulnerability flow in detail. The exploit demonstrates code execution through lodash _.template() by abusing the imports mechanism. In poc1.js, the attacker first pollutes Object.prototype.imports with an inherited enumerable property whose key is a JavaScript formal parameter containing a default expression: x=process.getBuiltinModule("child_process").execSync("curl https://example.com"). When _.template('', {}) is called with a plain object, lodash copies inherited properties via assignInWith()/keysIn(), causing the polluted imports property to be incorporated into template options. Later, lodash constructs a Function(importsKeys, ...) call, treating the attacker-controlled key as a parameter definition and evaluating the default expression, which executes the shell command. poc2.js shows a variant that passes imports directly in the options object rather than relying on prior prototype pollution. Both variants aim to achieve arbitrary command execution in Node.js. The demonstrated payload is basic and hardcoded: it launches curl to https://example.com as a network-visible proof of execution. This makes the repository an operational PoC rather than a detection script. Repository structure is minimal and purpose-built: README.md documents the vulnerability mechanics and references relevant lodash source locations; POCs/poc1.js demonstrates exploitation via polluted Object.prototype; POCs/poc2.js demonstrates direct attacker-controlled imports injection; package metadata only exists to install the vulnerable lodash dependency. There is no framework integration, no persistence, and no post-exploitation logic beyond command execution.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.