Upstream information

CVE-2026-4800 at MITRE

Description

Impact:

The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.

When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.

Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector, the polluted keys are copied into the imports object and passed to Function().

Patches:

Users should upgrade to version 4.18.0.

Workarounds:

Do not pass untrusted input as key names in options.imports. Only use developer-controlled, static key names.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having critical severity.

CVSS v3 Scores
CVSS detail CNA (openjs) National Vulnerability Database
Base Score 8.1 9.8
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network Network
Attack Complexity High Low
Privileges Required None None
User Interaction None None
Scope Unchanged Unchanged
Confidentiality Impact High High
Integrity Impact High High
Availability Impact High High
CVSSv3 Version 3.1 3.1
No SUSE Bugzilla entries cross referenced.

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Liberty Linux 9
  • pcs >= 0.11.10-1.el9_7.3
  • pcs-snmp >= 0.11.10-1.el9_7.3
 Patchnames:
RHSA-2026:10710

SUSE Timeline for this CVE

CVE page created: Tue Mar 31 22:35:10 2026
CVE page last modified: Mon Apr 27 22:54:33 2026