CVE-2026-4800: Lodash `_.template` Arbitrary Code Injection — Broken 4.18.0 Patch Exposes Supply-Chain Patch-Pinning Risk — Threadlinqs Intelligence
As of 2026-08-26, CVE-2026-4800: Lodash `_.template` Arbitrary Code Injection — Broken 4.18.0 Patch Exposes Supply-Chain Patch-Pinning Risk is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-2151 · Severity: HIGH · CVSS: 8.1 · Status: PATCHED · Category: VULNERABILITY
CVE-2026-4800, an arbitrary code injection in lodash's `_.template` via unvalidated `options.imports` key names, affected every published lodash/lodash-es/lodash-amd/lodash.template version through
CVE-2026-4800 (GHSA-r5fr-rjxr-66jc, CVSS 3.1 8.1; Snyk separately scores it CVSS 4.0 8.6, EPSS 2.76% / 86th percentile) is a code-injection vulnerability in lodash's `_.template` function. The 2021 fix for CVE-2021-23337 validated the `variable` option to close off `Function()`-constructor injection, but the same validation was never applied to `options.imports` key names. Because both `variable` and `imports` ultimately feed attacker-influenced strings into the `Function()` constructor, an application that passes untrusted input as an `options.imports` key can have arbitrary JavaScript executed at template-compilation time. The vulnerability is compounded by `_.template`'s use of `assignInWith` (a `for..in`-based merge that walks inherited properties): if `Object.prototype` has already been polluted elsewhere in an application, the polluted keys are pulled into the imports object and executed as well. The flaw affects lodash, lodash-es, lodash-amd, and lodash.template versions >=4.0.0 through 4.17.23; CWE-94 (Improper Control of Generation of Code) is the primary classification, with CWE-1321 (Prototype Pollution) as a contributing/compounding weakness. GHSA-r5fr-rjxr-66jc credits reporters dolevmiz1, bugbunny-research, M0nd0R, and threalwinky, with UlisesGascon, falsyvalues, jonchurch, and jdalton as the reviewing/fixing developers.
The patch shipped as lodash 4.18.0 on March 31, 2026 alongside other hardening (prototype-pollution fixes in `_.unset`/`_.omit`, regenerated modular packages) but introduced its own regression: lodash-cli's internal dependency mapping for modular builds fell out of sync, so `template.js` in lodash-es/lodash-amd/lodash.template called `assignWith` without importing it, throwing `ReferenceError: assignWith is not defined at template.js:169` (also affecting `fromPairs`). Because lodash's own unit tests didn't exercise that code path, the regression passed CI and reached npm; consumers such as html-webpack-plugin's child-compilation step (which calls `template()` on `index.html`, and is itself a transitive dependency of react-scripts) broke within a day, and GitHub issue #6167 — filed by user aaa-jeff on March 31, 2026 — tracked the failure the same day it shipped, cross-linking discussion #6174. Lodash maintainers merged the fix (commit `879aaa93132d78c2f8d20c60279da9f8b21576d6`, which both validates `importsKeys` against the existing `reForbiddenIdentifierChars` regex and replaces `assignInWith` with `assignWith` to stop walking inherited/polluted properties) and released 4.18.1 on April 1, 2026, restoring the missing internal wiring across all four modular packages; collaborator jonchurch confirmed the fix worked on discussion #6174 on April 2, 2026. npm's deprecation notice on the broken 4.18.0 release pointed affected consumers to pin back to 4.17.21 (still vulnerable to CVE-2026-4800, but functional) as an interim workaround before 4.18.1 was validated.
Aikido Security's article uses this sequence as a case study in supply-chain governance, pairing it with the 2024 xz-utils backdoor (CVE-2024-3094, CVSS 10.0; versions 5.6.0/5.6.1, safe line 5.4.x) as illustrative — not newly-reported — context. A pseudonymous maintainer persona, 'Jia Tan' (GitHub handle JiaT75), began building legitimate-looking contribution history around 2021 and was supported by a cluster of sock-puppet accounts ('Jigar Kumar', 'krygorin4545', 'misoeater91') that applied sustained pressure on the original maintainer, Lasse Collin, to hand over commit/release authority — a roughly two-to-three-year campaign that culminated in co-maintainer status by early 2023. On February 23, 2024, JiaT75 committed the backdoor: two dormant, compressed malicious binaries disguised as corrupted test files were embedded in the repository, and a malicious `build-to-host.m4` macro — present only in release tarballs, not in the git history itself — extracted and spliced them into the build during `dpkg`/`rpm` packaging on x86-64 Linux systems u
Weaknesses (CWE)
CWE-94, CWE-1321
Target sectors: technology, software development, enterprise it, industrial edge computing
Target regions: Global
Timeline
- GitHub user 'Jia Tan' (JiaT75) creates an account and begins contributing to xz-utils-adjacent open-source projects, the start of a ~2-3 year trust-building campaign the article later cites alongside the lodash disclosure.
- Jia Tan is granted co-maintainer / release authority on xz-utils after roughly 18 months of legitimate-looking contributions, aided by sock-puppet accounts ('Jigar Kumar', 'krygorin4545', 'misoeater91') pressuring original maintainer Lasse Collin to hand over control.
- JiaT75 commits the malicious liblzma build-script backdoor to the xz-utils repository, including two dormant compressed malicious binaries disguised as corrupted test files.
- xz-utils 5.6.1 ships with an updated version of the backdoor binary; 5.6.0 and 5.6.1 are the only compromised releases (5.4.x remains uncompromised).
- PostgreSQL developer Andres Freund begins investigating anomalous SSH-login CPU usage and Valgrind errors on a Debian development system, the lead that surfaces the backdoor two days later.
- Andres Freund publicly discloses the xz-utils backdoor to the Openwall mailing list; CVE-2024-3094 (CVSS 10.0) is assigned. Compromised releases had reached Fedora Rawhide, Debian unstable, and an Ubuntu 24.04 LTS beta, but not yet stable production distributions.
- OpenSSF and the OpenJS Foundation issue a joint alert on social-engineering maintainer-takeover attempts, disclosing that OpenJS's Cross Project Council independently intercepted a similarly-patterned suspicious maintainer-access request on a popular JavaScript project and reported it to CISA.
- Lasse Collin releases xz-utils 5.6.2, the official patched version fully remediating CVE-2024-3094.
- Binarly researchers report that 35+ Docker Hub-hosted Linux images (12 directly compromised Debian images, others built transitively on top) still contain the xz-utils CVE-2024-3094 backdoor more than a year after disclosure; Debian declines to remove the flagged images.
- GHSA-r5fr-rjxr-66jc / CVE-2026-4800 is disclosed for lodash's _.template options.imports code injection; lodash 4.18.0 ships the intended fix the same day but silently drops the assignWith import in modular builds.
- GitHub issue #6167, filed by user aaa-jeff, reports that lodash-es 4.18.0's template() throws 'ReferenceError: assignWith is not defined', breaking consumers such as html-webpack-plugin (a transitive dependency of react-scripts) within a day of release.
- lodash 4.18.1 is released (commit 879aaa9), restoring the missing internal dependency wiring and fixing the regression across lodash, lodash-es, lodash-amd, and lodash.template.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-4800, T1585.001, T1608.001, T1195.001, T1195.002, T1190, T1059.007, T1554, T1027.009, T1574.006, T1556
