Detections
Analytics

SCA: security update for lodash, lodash-amd, lodash-es, lodash.template (GHSA-r5fr-rjxr-66jc)

critical Tenable Self-Hosted Container Security Plugin ID 439609

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation
 for the variable option in _.template but did not apply the same validation to options.imports key names.
 Both paths flow into the same Function() constructor sink. When an application passes untrusted input as
 options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary
 code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which
 enumerates inherited properties via for..in. If Object.prototype has been polluted by any other vector,
 the polluted keys are copied into the imports object and passed to Function(). Patches: Users should
 upgrade to version 4.18.0. Workarounds: Do not pass untrusted input as key names in options.imports. Only
 use developer-controlled, static key names. (CVE-2026-4800)

Solution

Update the lodash library and its related packages to version 4.18.0 or later.

See Also

https://github.com/advisories/GHSA-r5fr-rjxr-66jc

Plugin Details

Severity: Critical

ID: 439609

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 4/2/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.49

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-4800

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/1/2026

Vulnerability Publication Date: 3/31/2026

Reference Information

CVE: CVE-2026-4800

cwe: CWE-94