# CVE-2026-4800: Lodash `_.template` Arbitrary Code Injection — Broken 4.18.0 Patch Exposes Supply-Chain Patch-Pinning Risk

> CVE-2026-4800, an arbitrary code injection in lodash's `_.template` via unvalidated `options.imports` key names, affected every published lodash/lodash-es/lodash-amd/lodash.template version through 4.17.23. The intended fix, 4.18.0 (Mar 31, 2026), broke real projects within a day because a build-tooling desync dropped the `assignWith` import from modular builds; a working fix shipped as 4.18.1 (Apr 1, 2026). Aikido Security's Aug 26, 2026 article pairs this episode with the 2024 xz-utils backdoor to argue organizations should pin and evaluate dependencies rather than auto-upgrade on defaults.

- **Published:** 2026-08-26T00:00:00Z
- **Last reviewed:** 2026-08-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2151
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-lodash-template-injection-broken-patch-tl-2026-2151.webp?v=a928bf4d (Threadlinqs threat intel: CVE-2026-4800 Lodash: Supply-Chain Patch Risk (TL-2026-2151) — High severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-2151
- **Severity:** HIGH (CVSS 8.1)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (1 shown free below)
- **CVEs:** CVE-2026-4800, CVE-2021-23337, CVE-2026-2950

## Description

CVE-2026-4800 (GHSA-r5fr-rjxr-66jc, CVSS 3.1 8.1; Snyk separately scores it CVSS 4.0 8.6, EPSS 2.76% / 86th percentile) is a code-injection vulnerability in lodash's `_.template` function. The 2021 fix for CVE-2021-23337 validated the `variable` option to close off `Function()`-constructor injection, but the same validation was never applied to `options.imports` key names. Because both `variable` and `imports` ultimately feed attacker-influenced strings into the `Function()` constructor, an application that passes untrusted input as an `options.imports` key can have arbitrary JavaScript executed at template-compilation time. The vulnerability is compounded by `_.template`'s use of `assignInWith` (a `for..in`-based merge that walks inherited properties): if `Object.prototype` has already been polluted elsewhere in an application, the polluted keys are pulled into the imports object and executed as well. The flaw affects lodash, lodash-es, lodash-amd, and lodash.template versions >=4.0.0 through 4.17.23; CWE-94 (Improper Control of Generation of Code) is the primary classification, with CWE-1321 (Prototype Pollution) as a contributing/compounding weakness. GHSA-r5fr-rjxr-66jc credits reporters dolevmiz1, bugbunny-research, M0nd0R, and threalwinky, with UlisesGascon, falsyvalues, jonchurch, and jdalton as the reviewing/fixing developers.

The patch shipped as lodash 4.18.0 on March 31, 2026 alongside other hardening (prototype-pollution fixes in `_.unset`/`_.omit`, regenerated modular packages) but introduced its own regression: lodash-cli's internal dependency mapping for modular builds fell out of sync, so `template.js` in lodash-es/lodash-amd/lodash.template called `assignWith` without importing it, throwing `ReferenceError: assignWith is not defined at template.js:169` (also affecting `fromPairs`). Because lodash's own unit tests didn't exercise that code path, the regression passed CI and reached npm; consumers such as html-webpack-plugin's child-compilation step (which calls `template()` on `index.html`, and is itself a transitive dependency of react-scripts) broke within a day, and GitHub issue #6167 — filed by user aaa-jeff on March 31, 2026 — tracked the failure the same day it shipped, cross-linking discussion #6174. Lodash maintainers merged the fix (commit `879aaa93132d78c2f8d20c60279da9f8b21576d6`, which both validates `importsKeys` against the existing `reForbiddenIdentifierChars` regex and replaces `assignInWith` with `assignWith` to stop walking inherited/polluted properties) and released 4.18.1 on April 1, 2026, restoring the missing internal wiring across all four modular packages; collaborator jonchurch confirmed the fix worked on discussion #6174 on April 2, 2026. npm's deprecation notice on the broken 4.18.0 release pointed affected consumers to pin back to 4.17.21 (still vulnerable to CVE-2026-4800, but functional) as an interim workaround before 4.18.1 was validated.

Aikido Security's article uses this sequence as a case study in supply-chain governance, pairing it with the 2024 xz-utils backdoor (CVE-2024-3094, CVSS 10.0; versions 5.6.0/5.6.1, safe line 5.4.x) as illustrative — not newly-reported — context. A pseudonymous maintainer persona, 'Jia Tan' (GitHub handle JiaT75), began building legitimate-looking contribution history around 2021 and was supported by a cluster of sock-puppet accounts ('Jigar Kumar', 'krygorin4545', 'misoeater91') that applied sustained pressure on the original maintainer, Lasse Collin, to hand over commit/release authority — a roughly two-to-three-year campaign that culminated in co-maintainer status by early 2023. On February 23, 2024, JiaT75 committed the backdoor: two dormant, compressed malicious binaries disguised as corrupted test files were embedded in the repository, and a malicious `build-to-host.m4` macro — present only in release tarballs, not in the git history itself — extracted and spliced them into the build during `dpkg`/`rpm` packaging on x86-64 Linux systems using glibc/GCC. The resulting backdoored `liblzma` hooked OpenSSH's `RSA_public_decrypt` via a GNU indirect-function (IFUNC) resolver — a code path OpenSSH only touches because several distributions patch it to interface with systemd via `libsystemd`, which links `liblzma` — letting a holder of a specific Ed448 private key bypass SSH authentication and execute code remotely; Alex Stamos characterized the exposure as a potential 'master key' to hundreds of millions of internet-facing systems. PostgreSQL developer Andres Freund began investigating anomalous SSH-login CPU usage and Valgrind errors on a Debian development system on March 27, 2024, and publicly disclosed the backdoor on March 29, 2024; the compromised 5.6.0/5.6.1 releases had reached Fedora Rawhide, Debian unstable, and an Ubuntu 24.04 LTS beta but had not yet reached stable production distributions. Lasse Collin released the official patched 5.6.2 on May 29, 2024. On April 15, 2024, OpenSSF and the OpenJS Foundation issued a joint alert on social-engineering maintainer-takeover attempts after OpenJS's Cross Project Council independently intercepted a similarly-patterned suspicious request for maintainer access on a popular JavaScript project and reported it to CISA — evidence the Jia Tan playbook was not an isolated incident. The compromise's tail proved long-lived: in August 2025, Binarly researchers found the CVE-2024-3094 backdoor still present in 35+ Docker Hub-hosted Linux images (12 directly compromised Debian images, plus others built transitively on top of them), with Debian declining to remove the flagged images. The article's thesis: 'most software runs on decisions nobody made' — teams that auto-upgrade on default get the lodash 4.18.0 regression, and teams that never re-evaluate a trusted maintainer get xz-utils; the fix in both cases is deliberate version pinning, targeted backporting of specific fixes without forcing a new base version, and continuously governed (not filed-away) SBOMs, with package evaluation gated at the point of entry before a developer, agent, or build system consumes it. Per the source article and hunt scoping, CVE-2024-3094 is cited only as comparative context and is intentionally NOT included in this record's `cve_list`.

As of the NVD record's last modification (Aug 25, 2026), CVE-2026-4800 does not appear in CISA's Known Exploited Vulnerabilities catalog — there is no confirmed evidence of active in-the-wild exploitation. The practical blast radius is nonetheless broad given lodash's ubiquity: for example, an IBM security bulletin lists CVE-2026-4800 (alongside CVE-2026-2950) as affecting bundled lodash/lodash-es in IBM Edge Data Collector, illustrating exposure reaching into edge/IoT-adjacent products, not just typical web/Node.js backends.

## MITRE ATT&CK

- T1585.001 Social Media Accounts
- T1608.001 Upload Malware
- T1195.001 Compromise Software Dependencies and Development Tools
- T1195.002 Compromise Software Supply Chain
- T1190 Exploit Public-Facing Application
- T1059.007 JavaScript
- T1554 Compromise Host Software Binary
- T1027.009 Embedded Payloads
- T1574.006 Dynamic Linker Hijacking
- T1556 Modify Authentication Process

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Backdoored liblzma (CVE-2024-3094) Loaded into sshd — Auth-Bypass IFUNC Hijack** (`TL-2026-2151-SPL-003`)

Detects the specific compromised xz-utils/liblzma 5.6.0/5.6.1 shared library being mapped into an sshd process, consistent with the CVE-2024-3094 IFUNC resolver hijack of RSA_public_decrypt that lets an attacker holding the corresponding Ed448 private key bypass SSH authentication and execute code remotely. Included as comparative supply-chain infrastructure the source article pairs with CVE-2026-4800; relevant for any host that pulled xz-utils from a still-affected Docker Hub image (per Binarly's Aug 2025 findings) or an unpatched distro snapshot.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1556, T1574.006, T1027.009
- **Data sources:** linux_auditd, syslog, sysmon_linux
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=linux_secure OR index=sysmon sourcetype IN ("linux:secure","syslog","auditd")
(comm="sshd" OR process="sshd")
| regex _raw="(?i)(liblzma\.so\.5\.6\.0|liblzma\.so\.5\.6\.1)"
| eval mitre_technique="T1556,T1574.006"
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, src_ip
| where count > 0
| sort - count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "sshd"
| where ProcessCommandLine has_any ("liblzma.so.5.6.0", "liblzma.so.5.6.1")
| join kind=inner (
    DeviceLogonEvents
    | where Timestamp > ago(24h)
    | where LogonType in ("Network","Remote")
) on DeviceName
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, LogonType
| summarize EventCount=count() by DeviceName, AccountName, LogonType
```

### Sigma

```yaml
title: Backdoored liblzma Loaded into sshd Process (CVE-2024-3094 IFUNC Hijack)
id: c3061412-914c-4a3c-be7f-4d8b0c3f6a92
status: experimental
description: Detects the compromised xz-utils/liblzma 5.6.0-5.6.1 shared library being mapped into an sshd process, consistent with the CVE-2024-3094 IFUNC resolver hijack of RSA_public_decrypt enabling SSH authentication bypass. Cited by Aikido Security as comparative supply-chain context alongside CVE-2026-4800.
references:
  - https://en.wikipedia.org/wiki/XZ_Utils_backdoor
  - https://binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images
author: Threadlinqs Team
date: 2026/08/26
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith: '/sshd'
  selection_lib:
    CommandLine|contains:
      - 'liblzma.so.5.6.0'
      - 'liblzma.so.5.6.1'
  condition: selection_proc and selection_lib
falsepositives:
  - None expected; liblzma 5.6.0/5.6.1 are known-malicious pinned versions and should not appear in production sshd process maps
level: critical
tags:
  - attack.credential-access
  - attack.t1556
  - attack.defense-evasion
  - attack.t1574.006
  - attack.resource-development
  - attack.t1608.001
  - cve.2024.3094
```

**Known false positives:**

- Extremely low; liblzma 5.6.0/5.6.1 are specific known-compromised version strings and legitimate hosts should not have them loaded — verify via package manager version if the library path is ambiguous

**Tuning notes:** Requires process-argument or /proc/<pid>/maps visibility (auditd exec logging, EDR library-load telemetry, or a periodic maps scan) since standard syslog rarely records loaded shared-library paths; supplement with a scheduled inventory scan (`ldd $(which sshd)` / package-manager version check) on hosts where richer telemetry is unavailable, since 12+ compromised Docker Hub images were still shipping this library as of Aug 2025.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Vulnerable/Broken Lodash Ingestion + Maintainer-Access Anomaly on Dependency Repos (locked: unlock with TL Creds)
- DeviceProcessEvents: Node.js Spawning Shell/Script Interpreter Post-Compilation (locked: unlock with TL Creds)
- sshd Process Loads Backdoored liblzma 5.6.0/5.6.1 Correlated with Remote Logon (locked: unlock with TL Creds)
- Sigma: Lodash _.template Injection Payload in Web Request (locked: unlock with TL Creds)
- Sigma: Node.js Parent Spawns Interpreter/Script Host (locked: unlock with TL Creds)
- Sigma: sshd Process Maps Compromised liblzma 5.6.0/5.6.1 (locked: unlock with TL Creds)
- Lodash _.template Code Injection Payload — CVE-2026-4800 Exploitation Attempt (locked: unlock with TL Creds)
- Node.js Process Spawns Command Interpreter — Post-RCE Follow-on (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 20)

Defanged, TLP:CLEAR.

- File hash: `879aaa93132d78c2f8d20c60279da9f8b21576d6`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Software Supply Chain Security: Decisions, Not Defaults](https://www.aikido.dev/blog/software-supply-chain-security-decisions-not-defaults)
- [lodash vulnerable to Code Injection via `_.template` imports key names (GHSA-r5fr-rjxr-66jc)](https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc)
- [Arbitrary Code Injection in lodash | CVE-2026-4800 | Snyk](https://security.snyk.io/vuln/SNYK-JS-LODASH-15869625)
- [Lodash vulnerability update (issue #2834)](https://github.com/plouc/nivo/issues/2834)
- [Bug introduced in in 4.18.0 (discussion #6174)](https://github.com/lodash/lodash/discussions/6174)
- [assignWith is not defined in template() (issue #6167)](https://github.com/lodash/lodash/issues/6167)
- [lodash: fix code injection via _.template options.imports (commit 879aaa9)](https://github.com/lodash/lodash/commit/879aaa93132d78c2f8d20c60279da9f8b21576d6)
- [lodash/lodash Changelog Wiki](https://github.com/lodash/lodash/wiki/Changelog)
- [NVD - CVE-2026-4800](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-4800)
- [Security Bulletin: IBM Edge Data Collector uses lodash-4.17.21.tgz, lodash-es-4.17.21.tgz which is vulnerable to CVE-2026-2950, CVE-2026-4800](https://www.ibm.com/support/pages/security-bulletin-ibm-edge-data-collector-uses-lodash-41721tgz-lodash-es-41721tgz-which-vulnerable-cve-2026-2950-cve-2026-4800)
- [Code Injection in lodash | CVE-2021-23337 | Snyk (prior, related vulnerability)](https://security.snyk.io/vuln/SNYK-JS-LODASH-1040724)
- [XZ Utils backdoor](https://en.wikipedia.org/wiki/XZ_Utils_backdoor)
- [Open Source Security (OpenSSF) and OpenJS Foundations Issue Alert for Social Engineering Takeovers of Open Source Projects](https://openssf.org/blog/2024/04/15/open-source-security-openssf-and-openjs-foundations-issue-alert-for-social-engineering-takeovers-of-open-source-projects/)
- [Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks](https://thehackernews.com/2025/08/researchers-spot-xz-utils-backdoor-in.html)
- [Persistent Risk: XZ Utils Backdoor Still Lurking in Docker Images](https://binarly.io/blog/persistent-risk-xz-utils-backdoor-still-lurking-in-docker-images)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2151