# CVE-2026-4800: node-lodash: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validati... CVE-2026-4800 is fixed in 21 products on 1 platform, first by libjs-lodash 4.17.4+dfsg-1ubuntu0.1~esm1, released March 31, 2026. It is not reported as exploited. Patch Radar priority: Urgent. - Web page: https://patchblox.com/security/cve/CVE-2026-4800 - Priority: Urgent - CVSS: 9.8 (critical) - EPSS: 0.0281 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Mar 31, 2026 ## Description The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | cockpit RHEL 10 | 356.1-1.el10_2 | [RHBA-2026:21388](https://patchblox.com/security/data/fix/linux/rhba-2026-21388.md) | Mar 31, 2026 | | Linux | cockpit RHEL 9 | 0:356.1-1.el9_8 | [RHBA-2026:21387](https://patchblox.com/security/data/fix/linux/rhba-2026-21387.md) | May 27, 2026 | | Linux | cockpit-bridge RHEL 9 | 0:356.1-1.el9_8 | [RHBA-2026:21387](https://patchblox.com/security/data/fix/linux/rhba-2026-21387.md) | May 27, 2026 | | Linux | cockpit-doc RHEL 9 | 0:356.1-1.el9_8 | [RHBA-2026:21387](https://patchblox.com/security/data/fix/linux/rhba-2026-21387.md) | May 27, 2026 | | Linux | cockpit-files RHEL 10 | 43-1.el10 | [RHSA-2026:97194](https://patchblox.com/security/data/fix/linux/rhsa-2026-97194.md) | Mar 31, 2026 | | Linux | cockpit-files RHEL 9 | 0:43-1.el9 | [RHSA-2026:97538](https://patchblox.com/security/data/fix/linux/rhsa-2026-97538.md) | Nov 11, 2026 | | Linux | cockpit-ha-cluster almalinux 10 | 0.12.1-1.el10_1.3 | [ALSA-2026:10713](https://patchblox.com/security/data/fix/linux/alsa-2026-10713.md) | Apr 27, 2026 | | Linux | cockpit-ha-cluster ol 10 | 0:0.12.1-1.el10_1.3 | [ELSA-2026-10713](https://patchblox.com/security/data/fix/linux/elsa-2026-10713.md) | Apr 28, 2026 | | Linux | cockpit-image-builder RHEL 10 | 94.3-1.el10_2 | [RHSA-2026:24331](https://patchblox.com/security/data/fix/linux/rhsa-2026-24331.md) | Mar 31, 2026 | | Linux | cockpit-image-builder ol 10 | 0:94.3-1.0.1.el10_2 | [ELSA-2026-24331](https://patchblox.com/security/data/fix/linux/elsa-2026-24331.md) | Jul 16, 2026 | | Linux | cockpit-image-builder rocky 10 | 0:94.3-1.el10_2 | [RLSA-2026:24331](https://patchblox.com/security/data/fix/linux/rlsa-2026-24331.md) | Jun 11, 2026 | | Linux | cockpit-machines RHEL 10 | 355-1.el10 | [RHSA-2026:97238](https://patchblox.com/security/data/fix/linux/rhsa-2026-97238.md) | Mar 31, 2026 | | Linux | cockpit-machines RHEL 9 | 0:355-1.el9 | [RHSA-2026:97539](https://patchblox.com/security/data/fix/linux/rhsa-2026-97539.md) | Nov 11, 2026 | | Linux | cockpit-packagekit RHEL 9 | 0:356.1-1.el9_8 | [RHBA-2026:21387](https://patchblox.com/security/data/fix/linux/rhba-2026-21387.md) | May 27, 2026 | | Linux | cockpit-podman RHEL 10 | 129-1.el10 | [RHSA-2026:97193](https://patchblox.com/security/data/fix/linux/rhsa-2026-97193.md) | Mar 31, 2026 | | Linux | cockpit-podman RHEL 9 | 0:129-1.el9 | [RHSA-2026:97537](https://patchblox.com/security/data/fix/linux/rhsa-2026-97537.md) | Nov 11, 2026 | | Linux | cockpit-storaged RHEL 9 | 0:356.1-1.el9_8 | [RHBA-2026:21387](https://patchblox.com/security/data/fix/linux/rhba-2026-21387.md) | May 27, 2026 | | Linux | cockpit-system RHEL 9 | 0:356.1-1.el9_8 | [RHBA-2026:21387](https://patchblox.com/security/data/fix/linux/rhba-2026-21387.md) | May 27, 2026 | | Linux | cockpit-ws RHEL 9 | 0:356.1-1.el9_8 | [RHBA-2026:21387](https://patchblox.com/security/data/fix/linux/rhba-2026-21387.md) | May 27, 2026 | | Linux | cockpit-ws-selinux RHEL 9 | 0:356.1-1.el9_8 | [RHBA-2026:21387](https://patchblox.com/security/data/fix/linux/rhba-2026-21387.md) | May 27, 2026 | | Linux | libjs-lodash Ubuntu 18.04.6 LTS (bionic) | 4.17.4+dfsg-1ubuntu0.1~esm1 | [libjs-lodash 4.17.4+dfsg-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libjs-lodash-4.17.4-dfsg-1ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | libjs-lodash Ubuntu 20.04 LTS (focal) | 4.17.15+dfsg-2ubuntu0.1~esm1 | [libjs-lodash 4.17.15+dfsg-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libjs-lodash-4.17.15-dfsg-2ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | libjs-lodash Ubuntu 22.04.1 LTS (jammy) | 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1 | [libjs-lodash 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libjs-lodash-4.17.21-dfsg-cs8.31.198.20210220-5ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | libjs-lodash Ubuntu 24.04.5 LTS (noble) | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | [libjs-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libjs-lodash-4.17.21-dfsg-cs8.31.198.20210220-9ubuntu0.24.04.1-esm1.md) | Mar 31, 2026 | | Linux | libjs-lodash Ubuntu 25.10 (questing) | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 | [libjs-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-libjs-lodash-4.17.21-dfsg-cs8.31.198.20210220-9ubuntu0.25.10.1.md) | Mar 31, 2026 | | Linux | libjs-lodash Ubuntu 26.04.1 LTS (resolute) | 4.17.23+dfsg-1ubuntu0.1~esm1 | [libjs-lodash 4.17.23+dfsg-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libjs-lodash-4.17.23-dfsg-1ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | node-lodash Debian 12.15 (bookworm) | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 | [DEBIAN-CVE-2026-4800](https://patchblox.com/security/data/fix/linux/debian-cve-2026-4800.md) | Mar 31, 2026 | | Linux | node-lodash Debian 13.5 (trixie) | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 | [DEBIAN-CVE-2026-4800](https://patchblox.com/security/data/fix/linux/debian-cve-2026-4800.md) | Mar 31, 2026 | | Linux | node-lodash Debian 14 | 4.18.1+dfsg-1 | [DEBIAN-CVE-2026-4800](https://patchblox.com/security/data/fix/linux/debian-cve-2026-4800.md) | Mar 31, 2026 | | Linux | node-lodash Ubuntu 18.04.6 LTS (bionic) | 4.17.4+dfsg-1ubuntu0.1~esm1 | [node-lodash 4.17.4+dfsg-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-node-lodash-4.17.4-dfsg-1ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | node-lodash Ubuntu 20.04 LTS (focal) | 4.17.15+dfsg-2ubuntu0.1~esm1 | [node-lodash 4.17.15+dfsg-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-node-lodash-4.17.15-dfsg-2ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | node-lodash Ubuntu 22.04.1 LTS (jammy) | 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1 | [node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-node-lodash-4.17.21-dfsg-cs8.31.198.20210220-5ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | node-lodash Ubuntu 24.04.5 LTS (noble) | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | [node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-node-lodash-4.17.21-dfsg-cs8.31.198.20210220-9ubuntu0.24.04.1-esm1.md) | Mar 31, 2026 | | Linux | node-lodash Ubuntu 25.10 (questing) | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 | [node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-node-lodash-4.17.21-dfsg-cs8.31.198.20210220-9ubuntu0.25.10.1.md) | Mar 31, 2026 | | Linux | node-lodash Ubuntu 26.04.1 LTS (resolute) | 4.17.23+dfsg-1ubuntu0.1~esm1 | [node-lodash 4.17.23+dfsg-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-node-lodash-4.17.23-dfsg-1ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | node-lodash-packages Ubuntu 20.04 LTS (focal) | 4.17.15+dfsg-2ubuntu0.1~esm1 | [node-lodash-packages 4.17.15+dfsg-2ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-node-lodash-packages-4.17.15-dfsg-2ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | node-lodash-packages Ubuntu 22.04.1 LTS (jammy) | 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1 | [node-lodash-packages 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-node-lodash-packages-4.17.21-dfsg-cs8.31.198.20210220-5ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | node-lodash-packages Ubuntu 24.04.5 LTS (noble) | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1 | [node-lodash-packages 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-noble-node-lodash-packages-4.17.21-dfsg-cs8.31.198.20210220-9ubuntu0.24.04.1-esm1.md) | Mar 31, 2026 | | Linux | node-lodash-packages Ubuntu 25.10 (questing) | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 | [node-lodash-packages 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1](https://patchblox.com/security/data/fix/linux/ubuntu-questing-node-lodash-packages-4.17.21-dfsg-cs8.31.198.20210220-9ubuntu0.25.10.1.md) | Mar 31, 2026 | | Linux | node-lodash-packages Ubuntu 26.04.1 LTS (resolute) | 4.17.23+dfsg-1ubuntu0.1~esm1 | [node-lodash-packages 4.17.23+dfsg-1ubuntu0.1~esm1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-node-lodash-packages-4.17.23-dfsg-1ubuntu0.1-esm1.md) | Mar 31, 2026 | | Linux | pcs RHEL 10 | 0.12.0-3.el10_0.5 | [RHSA-2026:11470](https://patchblox.com/security/data/fix/linux/rhsa-2026-11470.md) | Apr 30, 2026 | | Linux | pcs RHEL 9 | 0:0.11.11-2.el9_8.1 | [RHSA-2026:19167](https://patchblox.com/security/data/fix/linux/rhsa-2026-19167.md) | Apr 30, 2026 | | Linux | pcs almalinux 9 | 0.11.11-2.el9_8.1 | [ALSA-2026:19167](https://patchblox.com/security/data/fix/linux/alsa-2026-19167.md) | May 19, 2026 | | Linux | pcs ol 10 | 0:0.12.1-1.el10_1.3 | [ELSA-2026-10713](https://patchblox.com/security/data/fix/linux/elsa-2026-10713.md) | Apr 28, 2026 | | Linux | pcs ol 9 | 0:0.11.10-1.el9_7.3 | [ELSA-2026-10710](https://patchblox.com/security/data/fix/linux/elsa-2026-10710.md) | Apr 26, 2026 | | Linux | pcs rocky 9 | 0:0.11.11-2.el9_8.1 | [RLSA-2026:19167](https://patchblox.com/security/data/fix/linux/rlsa-2026-19167.md) | May 28, 2026 | | Linux | pcs-snmp RHEL 9 | 0:0.11.11-2.el9_8.1 | [RHSA-2026:19167](https://patchblox.com/security/data/fix/linux/rhsa-2026-19167.md) | Apr 30, 2026 | | Linux | pcs-snmp almalinux 9 | 0.11.11-2.el9_8.1 | [ALSA-2026:19167](https://patchblox.com/security/data/fix/linux/alsa-2026-19167.md) | May 19, 2026 | | Linux | pcs-snmp ol 10 | 0:0.12.1-1.el10_1.3 | [ELSA-2026-10713](https://patchblox.com/security/data/fix/linux/elsa-2026-10713.md) | Apr 28, 2026 | | Linux | pcs-snmp ol 9 | 0:0.11.10-1.el9_7.3 | [ELSA-2026-10710](https://patchblox.com/security/data/fix/linux/elsa-2026-10710.md) | Apr 26, 2026 | | Linux | rhsm-icons RHEL 9 | 0:17-1.el9 | [RHSA-2026:97514](https://patchblox.com/security/data/fix/linux/rhsa-2026-97514.md) | Nov 11, 2026 | | Linux | subscription-manager-cockpit RHEL 10 | 17-1.el10 | [RHSA-2026:97090](https://patchblox.com/security/data/fix/linux/rhsa-2026-97090.md) | Mar 31, 2026 | | Linux | subscription-manager-cockpit RHEL 9 | 0:17-1.el9 | [RHSA-2026:97514](https://patchblox.com/security/data/fix/linux/rhsa-2026-97514.md) | Nov 11, 2026 | | Linux | yarnpkg Fedora 43 | 1.22.22-18.fc43 | [FEDORA-2026-085ABEEA02](https://patchblox.com/security/data/fix/linux/fedora-2026-085abeea02.md) | Apr 2, 2026 | --- Data as of 2026-11-11T01:43:54Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.