CVE-2026-4800: Lodash `_.template` Arbitrary Code Injection — Broken 4.18.0 Patch Exposes Supply-Chain Patch-Pinning Risk

Key facts

Detection coverage

As of 2026-08-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2151 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Backdoored liblzma (CVE-2024-3094) Loaded into sshd — Auth-Bypass IFUNC Hijack

Detects the specific compromised xz-utils/liblzma 5.6.0/5.6.1 shared library being mapped into an sshd process, consistent with the CVE-2024-3094 IFUNC resolver hijack of RSA_public_decrypt that lets an attacker holding the corresponding Ed448 private key bypass SSH authentication and execute code remotely. Included as comparative supply-chain infrastructure the source article pairs with CVE-2026-4800; relevant for any host that pulled xz-utils from a still-affected Docker Hub image (per Binarly's Aug 2025 findings) or an unpatched distro snapshot.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1556, T1574.006, T1027.009
• Data sources: linux_auditd, syslog, sysmon_linux
• Severity: critical
• Confidence: high

Splunk SPL

index=linux_secure OR index=sysmon sourcetype IN ("linux:secure","syslog","auditd")
(comm="sshd" OR process="sshd")
| regex _raw="(?i)(liblzma\.so\.5\.6\.0|liblzma\.so\.5\.6\.1)"
| eval mitre_technique="T1556,T1574.006"
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, src_ip
| where count > 0
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sshd"
| where ProcessCommandLine has_any ("liblzma.so.5.6.0", "liblzma.so.5.6.1")
| join kind=inner (
    DeviceLogonEvents
    | where Timestamp > ago(24h)
    | where LogonType in ("Network","Remote")
) on DeviceName
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, LogonType
| summarize EventCount=count() by DeviceName, AccountName, LogonType

Sigma

title: Backdoored liblzma Loaded into sshd Process (CVE-2024-3094 IFUNC Hijack)
id: c3061412-914c-4a3c-be7f-4d8b0c3f6a92
status: experimental
description: Detects the compromised xz-utils/liblzma 5.6.0-5.6.1 shared library being mapped into an sshd process, consistent with the CVE-2024-3094 IFUNC resolver hijack of RSA_public_decrypt enabling SSH authentication bypass. Cited by Aikido Security as comparative supply-chain context alongside CVE-2026-4800.
references:
  - https://en.wikipedia.org/wiki/XZ_Utils_backdoor
  - https://binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images
author: Threadlinqs Team
date: 2026/08/26
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith: '/sshd'
  selection_lib:
    CommandLine|contains:
      - 'liblzma.so.5.6.0'
      - 'liblzma.so.5.6.1'
  condition: selection_proc and selection_lib
falsepositives:
  - None expected; liblzma 5.6.0/5.6.1 are known-malicious pinned versions and should not appear in production sshd process maps
level: critical
tags:
  - attack.credential-access
  - attack.t1556
  - attack.defense-evasion
  - attack.t1574.006
  - attack.resource-development
  - attack.t1608.001
  - cve.2024.3094

Known false positives:

• Extremely low; liblzma 5.6.0/5.6.1 are specific known-compromised version strings and legitimate hosts should not have them loaded — verify via package manager version if the library path is ambiguous

Tuning notes: Requires process-argument or /proc/<pid>/maps visibility (auditd exec logging, EDR library-load telemetry, or a periodic maps scan) since standard syslog rarely records loaded shared-library paths; supplement with a scheduled inventory scan (`ldd $(which sshd)` / package-manager version check) on hosts where richer telemetry is unavailable, since 12+ compromised Docker Hub images were still shipping this library as of Aug 2025.

• 🔒 Vulnerable/Broken Lodash Ingestion + Maintainer-Access Anomaly on Dependency Repos · unlock with TL Creds
• 🔒 DeviceProcessEvents: Node.js Spawning Shell/Script Interpreter Post-Compilation · unlock with TL Creds
• 🔒 sshd Process Loads Backdoored liblzma 5.6.0/5.6.1 Correlated with Remote Logon · unlock with TL Creds
• 🔒 Sigma: Lodash _.template Injection Payload in Web Request · unlock with TL Creds
• 🔒 Sigma: Node.js Parent Spawns Interpreter/Script Host · unlock with TL Creds
• 🔒 Sigma: sshd Process Maps Compromised liblzma 5.6.0/5.6.1 · unlock with TL Creds
• 🔒 Lodash _.template Code Injection Payload — CVE-2026-4800 Exploitation Attempt · unlock with TL Creds
• 🔒 Node.js Process Spawns Command Interpreter — Post-RCE Follow-on · unlock with TL Creds

Indicators of compromise

As of 2026-08-26, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-2151.

Sample indicators (1 of 20)

• File hash: 879aaa93132d78c2f8d20c60279da9f8b21576d6

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

Technical analysis

Aikido Security's Aug 26, 2026 article pairs this episode with the 2024 xz-utils backdoor to argue organizations should pin and evaluate dependencies rather than auto-upgrade on defaults.

CVE-2026-4800 (GHSA-r5fr-rjxr-66jc, CVSS 3.1 8.1; Snyk separately scores it CVSS 4.0 8.6, EPSS 2.76% / 86th percentile) is a code-injection vulnerability in lodash's `_.template` function. The 2021 fix for CVE-2021-23337 validated the `variable` option to close off `Function()`-constructor injection, but the same validation was never applied to `options.imports` key names. Because both `variable` and `imports` ultimately feed attacker-influenced strings into the `Function()` constructor, an application that passes untrusted input as an `options.imports` key can have arbitrary JavaScript executed at template-compilation time. The vulnerability is compounded by `_.template`'s use of `assignInWith` (a `for..in`-based merge that walks inherited properties): if `Object.prototype` has already been polluted elsewhere in an application, the polluted keys are pulled into the imports object and executed as well. The flaw affects lodash, lodash-es, lodash-amd, and lodash.template versions >=4.0.0 through 4.17.23; CWE-94 (Improper Control of Generation of Code) is the primary classification, with CWE-1321 (Prototype Pollution) as a contributing/compounding weakness. GHSA-r5fr-rjxr-66jc credits reporters dolevmiz1, bugbunny-research, M0nd0R, and threalwinky, with UlisesGascon, falsyvalues, jonchurch, and jdalton as the reviewing/fixing developers.

The patch shipped as lodash 4.18.0 on March 31, 2026 alongside other hardening (prototype-pollution fixes in `_.unset`/`_.omit`, regenerated modular packages) but introduced its own regression: lodash-cli's internal dependency mapping for modular builds fell out of sync, so `template.js` in lodash-es/lodash-amd/lodash.template called `assignWith` without importing it, throwing `ReferenceError: assignWith is not defined at template.js:169` (also affecting `fromPairs`). Because lodash's own unit tests didn't exercise that code path, the regression passed CI and reached npm; consumers such as html-webpack-plugin's child-compilation step (which calls `template()` on `index.html`, and is itself a transitive dependency of react-scripts) broke within a day, and GitHub issue #6167 — filed by user aaa-jeff on March 31, 2026 — tracked the failure the same day it shipped, cross-linking discussion #6174. Lodash maintainers merged the fix (commit `879aaa93132d78c2f8d20c60279da9f8b21576d6`, which both validates `importsKeys` against the existing `reForbiddenIdentifierChars` regex and replaces `assignInWith` with `assignWith` to stop walking inherited/polluted properties) and released 4.18.1 on April 1, 2026, restoring the missing internal wiring across all four modular packages; collaborator jonchurch confirmed the fix worked on discussion #6174 on April 2, 2026. npm's deprecation notice on the broken 4.18.0 release pointed affected consumers to pin back to 4.17.21 (still vulnerable to CVE-2026-4800, but functional) as an interim workaround before 4.18.1 was validated.

Aikido Security's article uses this sequence as a case study in supply-chain governance, pairing it with the 2024 xz-utils backdoor (CVE-2024-3094, CVSS 10.0; versions 5.6.0/5.6.1, safe line 5.4.x) as illustrative — not newly-reported — context. A pseudonymous maintainer persona, 'Jia Tan' (GitHub handle JiaT75), began building legitimate-looking contribution history around 2021 and was supported by a cluster of sock-puppet accounts ('Jigar Kumar', 'krygorin4545', 'misoeater91') that applied sustained pressure on the original maintainer, Lasse Collin, to hand over commit/release authority — a roughly two-to-three-year campaign that culminated in co-maintainer status by early 2023. On February 23, 2024, JiaT75 committed the backdoor: two dormant, compressed malicious binaries disguised as corrupted test files were embedded in the repository, and a malicious `build-to-host.m4` macro — present only in release tarballs, not in the git history itself — extracted and spliced them into the build during `dpkg`/`rpm` packaging on x86-64 Linux systems using glibc/GCC. The resulting backdoored `liblzma` hooked OpenSSH's `RSA_public_decrypt` via a GNU indirect-function (IFUNC) resolver — a code path OpenSSH only touches because several distributions patch it to interface with systemd via `libsystemd`, which links `liblzma` — letting a holder of a specific Ed448 private key bypass SSH authentication and execute code remotely; Alex Stamos characterized the exposure as a potential 'master key' to hundreds of millions of internet-facing systems. PostgreSQL developer Andres Freund began investigating anomalous SSH-login CPU usage and Valgrind errors on a Debian development system on March 27, 2024, and publicly disclosed the backdoor on March 29, 2024; the compromised 5.6.0/5.6.1 releases had reached Fedora Rawhide, Debian unstable, and an Ubuntu 24.04 LTS beta but had not yet reached stable production distributions. Lasse Collin released the official patched 5.6.2 on May 29, 2024. On April 15, 2024, OpenSSF and the OpenJS Foundation issued a joint alert on social-engineering maintainer-takeover attempts after OpenJS's Cross Project Council independently intercepted a similarly-patterned suspicious request for maintainer access on a popular JavaScript project and reported it to CISA — evidence the Jia Tan playbook was not an isolated incident. The compromise's tail proved long-lived: in August 2025, Binarly researchers found the CVE-2024-3094 backdoor still present in 35+ Docker Hub-hosted Linux images (12 directly compromised Debian images, plus others built transitively on top of them), with Debian declining to remove the flagged images. The article's thesis: 'most software runs on decisions nobody made' — teams that auto-upgrade on default get the lodash 4.18.0 regression, and teams that never re-evaluate a trusted maintainer get xz-utils; the fix in both cases is deliberate version pinning, targeted backporting of specific fixes without forcing a new base version, and continuously governed (not filed-away) SBOMs, with package evaluation gated at the point of entry before a developer, agent, or build system consumes it. Per the source article and hunt scoping, CVE-2024-3094 is cited only as comparative context and is intentionally NOT included in this record's `cve_list`.

As of the NVD record's last modification (Aug 25, 2026), CVE-2026-4800 does not appear in CISA's Known Exploited Vulnerabilities catalog — there is no confirmed evidence of active in-the-wild exploitation. The practical blast radius is nonetheless broad given lodash's ubiquity: for example, an IBM security bulletin lists CVE-2026-4800 (alongside CVE-2026-2950) as affecting bundled lodash/lodash-es in IBM Edge Data Collector, illustrating exposure reaching into edge/IoT-adjacent products, not just typical web/Node.js backends.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.009 Embedded Payloads; T1574.006 Dynamic Linker Hijacking

Execution

T1059.007 JavaScript

Initial Access

T1190 Exploit Public-Facing Application; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Persistence

T1554 Compromise Host Software Binary

Credential Access

T1556 Modify Authentication Process

Resource Development

T1585.001 Social Media Accounts; T1608.001 Upload Malware

Remediation

Patches

• lodash / lodash-es / lodash-amd / lodash.template 4.18.1 — fixes both CVE-2026-4800 (options.imports validation) and the 4.18.0 assignWith regression

Immediate actions

• Upgrade all lodash/lodash-es/lodash-amd/lodash.template installations directly to 4.18.1 (skip 4.18.0, which is a deprecated/broken release)
• Audit codebases for any use of _.template where options.imports or options.variable key names can be influenced by untrusted/external input
• Add lodash to actively-monitored SBOM entries rather than treating the SBOM as a static, filed-away compliance artifact

Workarounds

• Do not pass untrusted or attacker-influenced input as options.imports or options.variable key names to _.template
• If unable to upgrade immediately, avoid lodash-es/lodash-amd/lodash.template 4.18.0 specifically due to its build-breaking regression; remain on 4.17.21 with compensating controls (block untrusted input to _.template) until 4.18.1 is validated in your build

Longer-term hardening

• Adopt deliberate version pinning for foundational dependencies instead of auto-upgrading on release defaults
• Backport targeted security fixes onto a proven, pinned base version rather than jumping to an unvetted new release
• Evaluate and gate new package versions at the point of entry (CI pipeline, build agent, developer install) before they are consumed, rather than trusting registry defaults
• Treat aggressive, persistent requests for commit/maintainer access on open-source dependencies as a social-engineering warning sign, per the OpenSSF/OpenJS April 2024 guidance

Affected and fixed versions

• lodash (OpenJS Foundation ecosystem project) — lodash / lodash-es / lodash-amd / lodash.template
  Vulnerable versions: >=4.0.0, <=4.17.23; 4.18.0 (intended fix, but broken by a build regression)
  Fixed in: 4.18.1

Timeline

• 2021-08-01 GitHub user 'Jia Tan' (JiaT75) creates an account and begins contributing to xz-utils-adjacent open-source projects, the start of a ~2-3 year trust-building campaign the article later cites alongside the lodash disclosure.
• 2023-01-01 Jia Tan is granted co-maintainer / release authority on xz-utils after roughly 18 months of legitimate-looking contributions, aided by sock-puppet accounts ('Jigar Kumar', 'krygorin4545', 'misoeater91') pressuring original maintainer Lasse Collin to hand over control.
• 2024-02-23 JiaT75 commits the malicious liblzma build-script backdoor to the xz-utils repository, including two dormant compressed malicious binaries disguised as corrupted test files.
• 2024-03-09 xz-utils 5.6.1 ships with an updated version of the backdoor binary; 5.6.0 and 5.6.1 are the only compromised releases (5.4.x remains uncompromised).
• 2024-03-27 PostgreSQL developer Andres Freund begins investigating anomalous SSH-login CPU usage and Valgrind errors on a Debian development system, the lead that surfaces the backdoor two days later.
• 2024-03-29 Andres Freund publicly discloses the xz-utils backdoor to the Openwall mailing list; CVE-2024-3094 (CVSS 10.0) is assigned. Compromised releases had reached Fedora Rawhide, Debian unstable, and an Ubuntu 24.04 LTS beta, but not yet stable production distributions.
• 2024-04-15 OpenSSF and the OpenJS Foundation issue a joint alert on social-engineering maintainer-takeover attempts, disclosing that OpenJS's Cross Project Council independently intercepted a similarly-patterned suspicious maintainer-access request on a popular JavaScript project and reported it to CISA.
• 2024-05-29 Lasse Collin releases xz-utils 5.6.2, the official patched version fully remediating CVE-2024-3094.
• 2025-08-01 Binarly researchers report that 35+ Docker Hub-hosted Linux images (12 directly compromised Debian images, others built transitively on top) still contain the xz-utils CVE-2024-3094 backdoor more than a year after disclosure; Debian declines to remove the flagged images.
• 2026-03-31 GitHub issue #6167, filed by user aaa-jeff, reports that lodash-es 4.18.0's template() throws 'ReferenceError: assignWith is not defined', breaking consumers such as html-webpack-plugin (a transitive dependency of react-scripts) within a day of release.
• 2026-03-31 GHSA-r5fr-rjxr-66jc / CVE-2026-4800 is disclosed for lodash's _.template options.imports code injection; lodash 4.18.0 ships the intended fix the same day but silently drops the assignWith import in modular builds.
• 2026-04-01 lodash 4.18.1 is released (commit 879aaa9), restoring the missing internal dependency wiring and fixing the regression across lodash, lodash-es, lodash-amd, and lodash.template.
• 2026-04-02 Lodash collaborator jonchurch confirms on discussion #6174 that 4.18.1 resolves the assignWith regression across all affected modular packages.
• 2026-08-25 NVD's CVE-2026-4800 record is last modified; the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, indicating no confirmed active exploitation as of this date.
• 2026-08-26 Aikido Security publishes 'Software Supply Chain Security: Decisions, Not Defaults,' pairing the lodash 4.18.0/4.18.1 episode with the 2024 xz-utils backdoor to argue for deliberate dependency pinning, backporting, and continuously governed SBOMs over blind auto-upgrades.

Sources cited

Showing 15 of 16 sources, primary sources first.

• lodash vulnerable to Code Injection via `_.template` imports key names (GHSA-r5fr-rjxr-66jc) GitHub · Advisory · 2026-03-31
• Arbitrary Code Injection in lodash | CVE-2026-4800 | Snyk security.snyk.io · Advisory · 2026-04-01
• NVD - CVE-2026-4800 NVD (NIST) · Advisory · 2026-03-31
• Code Injection in lodash | CVE-2021-23337 | Snyk (prior, related vulnerability) security.snyk.io · Advisory · 2021-02-15
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-4800 not listed as of this record) CISA · Government advisory · 2026-08-26
• Security Bulletin: IBM Edge Data Collector uses lodash-4.17.21.tgz, lodash-es-4.17.21.tgz which is vulnerable to CVE-2026-2950, CVE-2026-4800 ibm.com · Vendor report · 2026-08-25
• XZ Utils backdoor en.wikipedia.org · Research · 2024-03-29
• Persistent Risk: XZ Utils Backdoor Still Lurking in Docker Images binarly.io · Research · 2025-08-01
• Lodash vulnerability update (issue #2834) GitHub · Code repository · 2026-03-31
• Bug introduced in in 4.18.0 (discussion #6174) GitHub · Code repository · 2026-03-31
• assignWith is not defined in template() (issue #6167) GitHub · Code repository · 2026-03-31
• lodash: fix code injection via _.template options.imports (commit 879aaa9) GitHub · Code repository · 2026-03-31
• lodash/lodash Changelog Wiki GitHub · Code repository · 2026-04-01
• Software Supply Chain Security: Decisions, Not Defaults aikido.dev · Blog · 2026-08-26
• Open Source Security (OpenSSF) and OpenJS Foundations Issue Alert for Social Engineering Takeovers of Open Source Projects openssf.org · Blog · 2024-04-15

Related threats

• AI Skill-Scanner Bypass — ClawHub, Cisco & Vercel Malicious-Skill Detectors Evaded via Truncation, .pyc Bytecode, Archive Indirection & Prompt Injection (Trail of Bits)
• Heap Overflow Chain in Titan Quest: Anniversary Edition via Malicious Custom Map/Particle Files
• HalluSquatting: Attacker-Registered Hallucinated Resource Names Fueling Agentic Botnets
• CIFSwitch — Linux Kernel CIFS/SPNEGO Key Validation Logic Flaw Enables Unprivileged Local Root via cifs.upcall Namespace Hijack (Public PoC, CVE Pending)

Previous and next in vulnerability

• AMD Ionic Cloud Driver Vulnerabilities Affecting VMware ESX (CVE-2025-62623, CVE-2025-62624, CVE-2025-62627) Previous report
• Adobe and Nvidia Patch Dozens of Vulnerabilities Across Multiple Products, Including Two Critical Flaws in Nvidia's NemoClaw AI Agent Stack and a CVSS 10.0 Adobe Campaign Classic Chain Next report

Further reading

• npm Supply Chain Attacks 2026: 218 Packages
• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs