lodash-es vulnerabilities

1 known vulnerability in lodash-es from Lodash. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  lodash: Improper Control of Generation of Code

  CVE-2026-4800Mar 31, 2026LodashEPSS 2.81%

  The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as o