lodash: Improper Control of Generation of Code

What to do

1. Update lodash to 4.18.1 or a later version.
2. Update lodash-es to 4.18.1 or a later version.
3. Update lodash-amd to 4.18.1 or a later version.
4. Read the advisory on cna.openjsf.org for workarounds and exact fixed builds.
5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

Version data comes from the organisation that assigned the CVE; 35 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector

NetworkCan be exploited remotely over a network, including the internet.

Attack complexity

LowNo special conditions are needed; the attack works reliably.

Privileges required

NoneNo account or login is needed.

User interaction

NoneNo action by a victim is required.

Scope

UnchangedImpact stays within the vulnerable component.

Confidentiality

HighAll data handled by the component can be read.

Integrity

HighData or code can be modified at will.

Availability

HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Control of Generation of Code

Timeline

1. March 31, 2026CVE record published.
2. March 31, 2026CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
3. October 15, 2026Record last changed materially (score, affected products, status or references).

References

Recent Improper Control of Generation of Code vulnerabilities

• 7.1 High severity

  ruby-lsp: Improper Control of Generation of Code

  CVE-2026-34060Mar 31, 2026Shopify
• 9.8 Critical severity

  Everest Forms Pro: Improper Control of Generation of Code

  CVE-2026-3300Mar 31, 2026WpeverestEPSS 39.2%
• 9.8 Critical severity

  Contact Form by Supsystic: Improper Control of Generation of Code

  CVE-2026-4257Mar 30, 2026SupsysticcomEPSS 41.5%
• 9.8 Critical severity

  Cline: Improper Control of Generation of Code

  CVE-2026-30313Mar 30, 2026ClineEPSS 1.19%
• 9.8 Critical severity

  Hai Build: Improper Control of Generation of Code

  CVE-2026-30308Mar 30, 2026Presidio
• 9.8 Critical severity

  Sakadev: Improper Control of Generation of Code

  CVE-2026-30306Mar 30, 2026Rahmanazhar

Spotted an error? Tell us.