CVE-2026-4800 Common Vulnerabilities and Exposures

Upstream information

CVE-2026-4800 at MITRE

Description

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having critical severity.

CVSS v3 Scores
CVSS detail	CNA (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)	CNA (openjs)	National Vulnerability Database
Base Score	8.1	8.1	9.8
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector	Network	Network	Network
Attack Complexity	High	High	Low
Privileges Required	None	None	None
User Interaction	None	None	None
Scope	Unchanged	Unchanged	Unchanged
Confidentiality Impact	High	High	High
Integrity Impact	High	High	High
Availability Impact	High	High	High
CVSSv3 Version	3.1	3.1	3.1

No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

RHSA-2026:10710, published Mon Apr 27 15:07:36 UTC 2026
RHSA-2026:10713, published Wed Apr 29 15:08:33 UTC 2026
RHSA-2026:11471, published Wed Jul 15 11:24:57 UTC 2026

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Liberty Linux 10	`cockpit-ha-cluster >= 0.12.1-1.el10_1.3` `cockpit-image-builder >= 94.3-1.el10_2.1` `pcs >= 0.12.1-1.el10_1.3` `pcs-snmp >= 0.12.1-1.el10_1.3`	Patchnames: ESEA-2026:0136 RHSA-2026:10713 (x86_64)
SUSE Liberty Linux 9.6 EMS	`pcs >= 0.11.9-2.el9_6.4` `pcs-snmp >= 0.11.9-2.el9_6.4`	Patchnames: RHSA-2026:11471 (x86_64)
SUSE Liberty Linux 9	`pcs >= 0.11.10-1.el9_7.3` `pcs-snmp >= 0.11.10-1.el9_7.3`	Patchnames: RHSA-2026:10710 (x86_64)

SUSE Timeline for this CVE

CVE page created: Tue Mar 31 22:35:10 2026
CVE page last modified: Thu Oct 15 12:32:44 2026