GHSA-r5fr-rjxr-66jc: lodash vulnerable to Code Injection via `_.template` imports key names
Summary
The lodash library has a code injection vulnerability in its `_.template` function (a tool that generates reusable text templates with dynamic values). Attackers can inject malicious code through the `options.imports` parameter, either by passing untrusted input as key names or by exploiting prototype pollution (a technique where attackers modify the default object properties that all objects inherit from). This allows arbitrary code to run when a template is compiled.
Solution / Mitigation
Users should upgrade to lodash version 4.18.0. The fix validates import key names using the same security checks applied to the `variable` option, and it changes how imports are merged to prevent inherited properties from being included.
Vulnerability Details
EPSS: 0.1%
Yes
April 1, 2026
Classification
Affected Vendors
Affected Packages
Original source: https://github.com/advisories/GHSA-r5fr-rjxr-66jc
First tracked: April 1, 2026 at 08:00 PM
Classified by LLM (prompt v3) · confidence: 75%