Arbitrary code execution in lodash template imports

This repository is a small JavaScript proof-of-concept for CVE-2026-4800 affecting lodash template handling. It contains two executable PoC files under POCs/, a minimal package.json/package-lock.json pinning lodash 4.17.23, and a README that explains the vulnerability flow in detail. The exploit demonstrates code execution through lodash _.template() by abusing the imports mechanism. In poc1.js, the attacker first pollutes Object.prototype.imports with an inherited enumerable property whose key is a JavaScript formal parameter containing a default expression: x=process.getBuiltinModule("child_process").execSync("curl https://example.com"). When _.template('', {}) is called with a plain object, lodash copies inherited properties via assignInWith()/keysIn(), causing the polluted imports property to be incorporated into template options. Later, lodash constructs a Function(importsKeys, ...) call, treating the attacker-controlled key as a parameter definition and evaluating the default expression, which executes the shell command. poc2.js shows a variant that passes imports directly in the options object rather than relying on prior prototype pollution. Both variants aim to achieve arbitrary command execution in Node.js. The demonstrated payload is basic and hardcoded: it launches curl to https://example.com as a network-visible proof of execution. This makes the repository an operational PoC rather than a detection script. Repository structure is minimal and purpose-built: README.md documents the vulnerability mechanics and references relevant lodash source locations; POCs/poc1.js demonstrates exploitation via polluted Object.prototype; POCs/poc2.js demonstrates direct attacker-controlled imports injection; package metadata only exists to install the vulnerable lodash dependency. There is no framework integration, no persistence, and no post-exploitation logic beyond command execution.