Detections
Analytics
Echo: lodash: security update to 4.18.0
critical Tenable Self-Hosted Container Security Plugin ID 460996
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the
same validation to options.imports key names, and both paths flow into the same Function() constructor
sink. When an application passes untrusted input as options.imports key names, an attacker can inject
default-parameter expressions that execute arbitrary code at template compilation time. Additionally,
_.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if
Object.prototype has been polluted by another vector the polluted keys are copied into the imports object
and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and
lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only
developer-controlled, static key names. (CVE-2026-4800)
Solution
Update the lodash library and its related packages to version 4.18.0 or later.See Also
Plugin Details
Severity: Critical
ID: 460996
Version: Revision 1.2
Type: Local
Family: Echo Local Security Checks
Published: 10/2/2026
Updated: 10/16/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.51
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-4800
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/1/2026
Vulnerability Publication Date: 3/31/2026
Reference Information
CVE: CVE-2026-4800