CVE-2026-4800 (GHSA-r5fr-rjxr-66jc, CVSS 3.1 8.1; Snyk separately scores it CVSS 4.0 8.6, EPSS 2.76% / 86th percentile) is a code-injection vulnerability in lodash's `_.template` function. The 2021 fix for CVE-2021-23337 validated the `variable` option to close off `Function()`-constructor injection, but the same validation was never applied to `options.imports` key names. Because both `variable` and `imports` ultimately feed attacker-influenced strings into the `Function()` constructor, an application that passes untrusted input as an `options.imports` key can have arbitrary JavaScript executed at template-compilation time. The vulnerability is compounded by `_.template`'s use of `assignInWith` (a `for..in`-based merge that walks inherited properties): if `Object.prototype` has already been polluted elsewhere in an application, the polluted keys are pulled into the imports object and executed as well. The flaw affects lodash, lodash-es, lodash-amd, and lodash.template versions >=4.0.0 through 4.17.23; CWE-94 (Improper Control of Generation of Code) is the primary classification, with CWE-1321 (Prototype Pollution) as a contributing/compounding weakness. GHSA-r5fr-rjxr-66jc credits reporters dolevmiz1, bugbunny-research, M0nd0R, and threalwinky, with UlisesGascon, falsyvalues, jonchurch, and jdalton as the reviewing/fixing developers.

The patch shipped as lodash 4.18.0 on March 31, 2026 alongside other hardening (prototype-pollution fixes in `_.unset`/`_.omit`, regenerated modular packages) but introduced its own regression: lodash-cli's internal dependency mapping for modular builds fell out of sync, so `template.js` in lodash-es/lodash-amd/lodash.template called `assignWith` without importing it, throwing `ReferenceError: assignWith is not defined at template.js:169` (also affecting `fromPairs`). Because lodash's own unit tests didn't exercise that code path, the regression passed CI and reached npm; consumers such as html-webpack-plugin's child-compilation step (which calls `template()` on `index.html`, and is itself a transitive dependency of react-scripts) broke within a day, and GitHub issue #6167 — filed by user aaa-jeff on March 31, 2026 — tracked the failure the same day it shipped, cross-linking discussion #6174. Lodash maintainers merged the fix (commit `879aaa93132d78c2f8d20c60279da9f8b21576d6`, which both validates `importsKeys` against the existing `reForbiddenIdentifierChars` regex and replaces `assignInWith` with `assignWith` to stop walking inherited/polluted properties) and released 4.18.1 on April 1, 2026, restoring the missing internal wiring across all four modular packages; collaborator jonchurch confirmed the fix worked on discussion #6174 on April 2, 2026. npm's deprecation notice on the broken 4.18.0 release pointed affected consumers to pin back to 4.17.21 (still vulnerable to CVE-2026-4800, but functional) as an interim workaround before 4.18.1 was validated.

Aikido Security's article uses this sequence as a case study in supply-chain governance, pairing it with the 2024 xz-utils backdoor (CVE-2024-3094, CVSS 10.0; versions 5.6.0/5.6.1, safe line 5.4.x) as illustrative — not newly-reported — context. A pseudonymous maintainer persona, 'Jia Tan' (GitHub handle JiaT75), began building legitimate-looking contribution history around 2021 and was supported by a cluster of sock-puppet accounts ('Jigar Kumar', 'krygorin4545', 'misoeater91') that applied sustained pressure on the original maintainer, Lasse Collin, to hand over commit/release authority — a roughly two-to-three-year campaign that culminated in co-maintainer status by early 2023. On February 23, 2024, JiaT75 committed the backdoor: two dormant, compressed malicious binaries disguised as corrupted test files were embedded in the repository, and a malicious `build-to-host.m4` macro — present only in release tarballs, not in the git history itself — extracted and spliced them into the build during `dpkg`/`rpm` packaging on x86-64 Linux systems using glibc/GCC. The resulting backdoored `liblzma` hooked OpenSSH's `RSA_public_decrypt` via a GNU indirect-function (IFUNC) resolver — a code path OpenSSH only touches because several distributions patch it to interface with systemd via `libsystemd`, which links `liblzma` — letting a holder of a specific Ed448 private key bypass SSH authentication and execute code remotely; Alex Stamos characterized the exposure as a potential 'master key' to hundreds of millions of internet-facing systems. PostgreSQL developer Andres Freund began investigating anomalous SSH-login CPU usage and Valgrind errors on a Debian development system on March 27, 2024, and publicly disclosed the backdoor on March 29, 2024; the compromised 5.6.0/5.6.1 releases had reached Fedora Rawhide, Debian unstable, and an Ubuntu 24.04 LTS beta but had not yet reached stable production distributions. Lasse Collin released the official patched 5.6.2 on May 29, 2024. On April 15, 2024, OpenSSF and the OpenJS Foundation issued a joint alert on social-engineering maintainer-takeover attempts after OpenJS's Cross Project Council independently intercepted a similarly-patterned suspicious request for maintainer access on a popular JavaScript project and reported it to CISA — evidence the Jia Tan playbook was not an isolated incident. The compromise's tail proved long-lived: in August 2025, Binarly researchers found the CVE-2024-3094 backdoor still present in 35+ Docker Hub-hosted Linux images (12 directly compromised Debian images, plus others built transitively on top of them), with Debian declining to remove the flagged images. The article's thesis: 'most software runs on decisions nobody made' — teams that auto-upgrade on default get the lodash 4.18.0 regression, and teams that never re-evaluate a trusted maintainer get xz-utils; the fix in both cases is deliberate version pinning, targeted backporting of specific fixes without forcing a new base version, and continuously governed (not filed-away) SBOMs, with package evaluation gated at the point of entry before a developer, agent, or build system consumes it. Per the source article and hunt scoping, CVE-2024-3094 is cited only as comparative context and is intentionally NOT included in this record's `cve_list`.

As of the NVD record's last modification (Aug 25, 2026), CVE-2026-4800 does not appear in CISA's Known Exploited Vulnerabilities catalog — there is no confirmed evidence of active in-the-wild exploitation. The practical blast radius is nonetheless broad given lodash's ubiquity: for example, an IBM security bulletin lists CVE-2026-4800 (alongside CVE-2026-2950) as affecting bundled lodash/lodash-es in IBM Edge Data Collector, illustrating exposure reaching into edge/IoT-adjacent products, not just typical web/Node.js backends.