crítica
CVE-2026-4800
lodash: lodash: Arbitrary code execution via untrusted input in template imports
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Red Hat (alta), AlmaLinux (alta), Oracle (alta), Rocky Linux (alta), Ubuntu (media).
Descripción
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.3 |
| alma 9 | pcs, pcs-snmp | 0.11.11-2.el9_8.1 |
| chainguard | arangodb-3.11, arangodb-3.12, argo-workflows-3.6 y 56 más | 3.11.14.3-r5 y 57 más |
| debian 11 | node-lodash | 4.17.21+dfsg+~cs8.31.173-1+deb11u1 |
| debian 12 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| debian 13 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 |
| debian 14 | node-lodash | 4.18.1+dfsg-1 |
| echo | moodle-4.5, moodle-5.0, moodle-5.1 y 3 más | 4.5.15+e2 y 5 más |
| echo npm::Echo OSV | lodash, lodash-es | 4.17.21+echo.1 |
| minimos | arangodb-3.11, arangodb-3.12, argo-workflows-3.7 y 17 más | 3.11.14.3-r2 y 13 más |
| npm::GitHub Security Advisory npm | lodash, lodash-amd, lodash-es y 1 más | 4.18.0 |
| Oracle Linux 9 | pcs, pcs-snmp | 0.11.11-2.el9_8.1 |
Mostrar las 292 entradas de 38 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alma 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.3 |
| alma 9 | pcs | 0.11.11-2.el9_8.1 |
| alma 9 | pcs-snmp | 0.11.11-2.el9_8.1 |
| chainguard | arangodb-3.11 | 3.11.14.3-r5 |
| chainguard | arangodb-3.12 | 3.12.7.2-r5 |
| chainguard | argo-workflows-3.6 | 3.6.19-r5 |
| chainguard | argo-workflows-3.7 | 3.7.13-r0 |
| chainguard | argo-workflows-4.0 | 4.0.4-r0 |
| chainguard | code-server | 4.112.0-r2 |
| chainguard | drupal-11.3 | 11.3.13-r3 |
| chainguard | foxx-cli | 2.1.1-r6 |
| chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| chainguard | gitlab-rails-ce-19.0 | 19.0.3-r1 |
| chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| chainguard | gitlab-rails-ce-19.5 | 19.5.1-r0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r15 |
| chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| chainguard | gitlab-rails-ce-fips-19.1 | 19.1.1-r1 |
| chainguard | jitsucom-jitsu | 2.11.0-r19 |
| chainguard | json-server | 0.17.4-r6 |
| chainguard | jupyter-base-notebook | 7.6.3-r2 |
| chainguard | kibana-8.17 | 8.17.10-r17 |
| chainguard | kibana-8.19 | 8.19.14-r2 |
| chainguard | kibana-9.0 | 9.0.8-r19 |
| chainguard | kibana-9.1 | 9.1.10-r12 |
| chainguard | kibana-9.2 | 9.2.7-r5 |
| chainguard | kibana-9.3 | 9.3.3-r4 |
| chainguard | kibana-9.4 | 9.4.2-r0 |
| chainguard | kubeflow-centraldashboard | 1.10.0-r18 |
| chainguard | kubeflow-katib | 0.19.0-r40 |
| chainguard | kubeflow-pipelines | 2.16.0-r11 |
| chainguard | langfuse-2 | 2.95.12-r17 |
| chainguard | langfuse-3 | 3.164.0-r1 |
| chainguard | langfuse-fips-2 | 2.95.12-r20 |
| chainguard | langfuse-fips-3 | 3.164.0-r1 |
| chainguard | librechat | 0.8.4-r5 |
| chainguard | npm | 11.12.1-r3 |
| chainguard | opensearch-dashboards-2 | 2.19.5-r8 |
| chainguard | opensearch-dashboards-2-fips | 2.19.5-r7 |
| chainguard | opensearch-dashboards-3 | 3.5.0-r15 |
| chainguard | opensearch-dashboards-3-fips | 3.5.0-r9 |
| chainguard | pelias-api | 7.6.0-r6 |
| chainguard | prism | 5.15.6-r2 |
| chainguard | py3-captum | 0.9.0-r1 |
| chainguard | py3-jupyterlab | 4.6.1-r1 |
| chainguard | redisinsight | 3.2.0-r5 |
| chainguard | renovate | 43.104.7-r1 |
| chainguard | saf | 1.6.0-r0 |
| chainguard | semaphore | 2.18.12-r2 |
| chainguard | sqlpad | 7.5.7-r17 |
| chainguard | tensorflow-cpu-jupyter | 2.21.0-r8 |
| chainguard | tensorflow-gpu-jupyter | 0 |
| chainguard | ts-patch | 4.0.1-r3 |
| chainguard | vitess-22 | 22.0.4-r9 |
| chainguard | vitess-23 | 23.0.3-r12 |
| chainguard | wazuh-dashboard | 4.14.4-r1 |
| chainguard | wazuh-dashboard-fips | 4.14.7-r8 |
| debian 11 | node-lodash | 4.17.21+dfsg+~cs8.31.173-1+deb11u1 |
| debian 12 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| debian 13 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 |
| debian 14 | node-lodash | 4.18.1+dfsg-1 |
| echo | moodle-4.5 | 4.5.15+e2 |
| echo | moodle-5.0 | 5.0.11+e2 |
| echo | moodle-5.1 | 5.1.8+e2 |
| echo | moodle-5.2 | 5.2.4+e2 |
| echo | moodle-5.3 | 5.3.0+e2 |
| echo | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| echo npm::Echo OSV | lodash | 4.17.21+echo.1 |
| echo npm::Echo OSV | lodash-es | 4.17.21+echo.1 |
| minimos | arangodb-3.11 | 3.11.14.3-r2 |
| minimos | arangodb-3.12 | 3.12.7.1-r1 |
| minimos | argo-workflows-3.7 | 3.7.13-r0 |
| minimos | argo-workflows-fips-3.7 | 3.7.13-r0 |
| minimos | cube-1.7 | 1.7.43-r0 |
| minimos | foxx-cli | 2.1.1-r1 |
| minimos | kibana-8.19 | 8.19.16-r0 |
| minimos | kibana-9.3 | 9.3.5-r0 |
| minimos | kibana-9.4 | 9.4.2-r0 |
| minimos | kubeflow-pipelines-frontend | 2.17.0-r0 |
| minimos | nginx-proxy-manager-2 | 2.14.0-r1 |
| minimos | openclaw | 2026.4.2-r0 |
| minimos | opensearch-dashboards-2 | 2.19.6-r0 |
| minimos | opensearch-dashboards-2-plugin-alerting-dashboards | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-anomaly-detection-dashboards | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-dashboards-flow-framework | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-dashboards-observability | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-security-analytics-dashboards | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-fips-2 | 2.19.6-r0 |
| minimos | verdaccio | 6.8.0-r0 |
| npm::GitHub Security Advisory npm | lodash | 4.18.0 |
| npm::GitHub Security Advisory npm | lodash-amd | 4.18.0 |
| npm::GitHub Security Advisory npm | lodash-es | 4.18.0 |
| npm::GitHub Security Advisory npm | lodash.template | 4.18.0 |
| Oracle Linux 9 | pcs | 0.11.11-2.el9_8.1 |
| Oracle Linux 9 | pcs-snmp | 0.11.11-2.el9_8.1 |
| rapidfort alma 10 | cockpit | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-bridge | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-doc | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-files | sin corrección indicada |
| rapidfort alma 10 | cockpit-image-builder | 0:94.3-1.el10_2 |
| rapidfort alma 10 | cockpit-machines | sin corrección indicada |
| rapidfort alma 10 | cockpit-packagekit | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-podman | sin corrección indicada |
| rapidfort alma 10 | cockpit-storaged | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-system | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-ws | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-ws-selinux | 0:356.1-1.el10_2 |
| rapidfort alma 10 | librados-devel | sin corrección indicada |
| rapidfort alma 10 | librados2 | sin corrección indicada |
| rapidfort alma 10 | libradospp-devel | sin corrección indicada |
| rapidfort alma 10 | librbd-devel | sin corrección indicada |
| rapidfort alma 10 | librbd1 | sin corrección indicada |
| rapidfort alma 8 | cockpit | sin corrección indicada |
| rapidfort alma 8 | cockpit-bridge | sin corrección indicada |
| rapidfort alma 8 | cockpit-doc | sin corrección indicada |
| rapidfort alma 8 | cockpit-machines | sin corrección indicada |
| rapidfort alma 8 | cockpit-packagekit | sin corrección indicada |
| rapidfort alma 8 | cockpit-storaged | sin corrección indicada |
| rapidfort alma 8 | cockpit-system | sin corrección indicada |
| rapidfort alma 8 | cockpit-ws | sin corrección indicada |
| rapidfort alma 9 | cockpit | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-bridge | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-doc | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-files | sin corrección indicada |
| rapidfort alma 9 | cockpit-machines | sin corrección indicada |
| rapidfort alma 9 | cockpit-packagekit | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-podman | sin corrección indicada |
| rapidfort alma 9 | cockpit-storaged | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-system | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-ws | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-ws-selinux | 0:356.1-1.el9_8 |
| rapidfort alma 9 | librados-devel | sin corrección indicada |
| rapidfort alma 9 | librados2 | sin corrección indicada |
| rapidfort alma 9 | libradospp-devel | sin corrección indicada |
| rapidfort alma 9 | librbd-devel | sin corrección indicada |
| rapidfort alma 9 | librbd1 | sin corrección indicada |
| rapidfort debian 12 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| rapidfort debian 13 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| rapidfort fedora 43 | cockpit-ha-cluster | 0.12.2-2.fc43 |
| rapidfort fedora 43 | nextcloud | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-httpd | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-mysql | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-nginx | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-postgresql | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-sqlite | 33.0.3-1.fc43 |
| rapidfort fedora 43 | pcs | 0.12.2-2.fc43 |
| rapidfort fedora 43 | pcs-snmp | 0.12.2-2.fc43 |
| rapidfort fedora 43 | pcs-web-ui | 0.12.2-2.fc43 |
| rapidfort fedora 43 | pgadmin4 | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-doc | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-httpd | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-cs | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-de | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-es | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-fr | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-it | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-ja | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-ko | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-pl | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-ru | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-qt | 9.14-1.fc43 |
| rapidfort fedora 43 | python-jupytext | 1.19.1-4.fc43 |
| rapidfort fedora 43 | python-jupytext-doc | 1.19.1-4.fc43 |
| rapidfort fedora 43 | python3-jupyterlab-jupytext | 1.19.1-4.fc43 |
| rapidfort fedora 43 | python3-jupytext | 1.19.1-4.fc43 |
| rapidfort fedora 43 | yarnpkg | 1.22.22-18.fc43 |
| rapidfort Oracle Linux 10 | cockpit | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-bridge | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-doc | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-files | sin corrección indicada |
| rapidfort Oracle Linux 10 | cockpit-ha-cluster | 0:0.12.2-3.el10_2.1 |
| rapidfort Oracle Linux 10 | cockpit-image-builder | 0:94.3-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-machines | sin corrección indicada |
| rapidfort Oracle Linux 10 | cockpit-packagekit | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-storaged | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-system | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-ws | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-ws-selinux | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | nextcloud | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-httpd | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-mysql | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-nginx | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-postgresql | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-sqlite | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | pcs | 0:0.12.2-3.el10_2.1 |
| rapidfort Oracle Linux 10 | pcs-snmp | 0:0.12.2-3.el10_2.1 |
| rapidfort Oracle Linux 10 | yarnpkg | 1.22.22-18.el10_3 |
| rapidfort Oracle Linux 9 | cockpit | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-bridge | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-doc | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-files | sin corrección indicada |
| rapidfort Oracle Linux 9 | cockpit-machines | sin corrección indicada |
| rapidfort Oracle Linux 9 | cockpit-packagekit | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-storaged | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-system | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-ws | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-ws-selinux | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | pcs | 0:0.11.11-2.el9_8.1 |
| rapidfort Oracle Linux 9 | pcs-snmp | 0:0.11.11-2.el9_8.1 |
| rapidfort Oracle Linux 9 | yarnpkg | 1.22.22-18.el9 |
| rapidfort Red Hat 10 | cockpit-podman | sin corrección indicada |
| rapidfort Red Hat 9 | cockpit-podman | sin corrección indicada |
| rapidfort rocky 10 | cockpit-files | sin corrección indicada |
| rapidfort rocky 10 | cockpit-machines | sin corrección indicada |
| rapidfort rocky 10 | cockpit-podman | sin corrección indicada |
| rapidfort rocky 8 | cockpit | sin corrección indicada |
| rapidfort rocky 8 | cockpit-bridge | sin corrección indicada |
| rapidfort rocky 8 | cockpit-machines | sin corrección indicada |
| rapidfort rocky 8 | cockpit-ws | sin corrección indicada |
| rapidfort rocky 9 | cockpit | 0:356.1-1.el9_8 |
| rapidfort rocky 9 | cockpit-bridge | 0:356.1-1.el9_8 |
| rapidfort rocky 9 | cockpit-files | sin corrección indicada |
| rapidfort rocky 9 | cockpit-machines | sin corrección indicada |
| rapidfort rocky 9 | cockpit-podman | sin corrección indicada |
| rapidfort rocky 9 | cockpit-ws | 0:356.1-1.el9_8 |
| rapidfort rocky 9 | cockpit-ws-selinux | 0:356.1-1.el9_8 |
| rapidfort ubuntu 20.04 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 20.04 | rf-node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 22.04 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 22.04 | rf-node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 24.04 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 24.04 | rf-node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| Red Hat | cockpit | sin corrección indicada |
| Red Hat | cockpit-bridge | sin corrección indicada |
| Red Hat | cockpit-dashboard | sin corrección indicada |
| Red Hat | cockpit-doc | sin corrección indicada |
| Red Hat | cockpit-files | sin corrección indicada |
| Red Hat | cockpit-machines | sin corrección indicada |
| Red Hat | cockpit-packagekit | sin corrección indicada |
| Red Hat | cockpit-pcp | sin corrección indicada |
| Red Hat | cockpit-podman | sin corrección indicada |
| Red Hat | cockpit-storaged | sin corrección indicada |
| Red Hat | cockpit-system | sin corrección indicada |
| Red Hat | cockpit-ws | sin corrección indicada |
| Red Hat | container-tools:rhel8::cockpit-podman | sin corrección indicada |
| Red Hat | librados-devel | sin corrección indicada |
| Red Hat | librados2 | sin corrección indicada |
| Red Hat | libradospp-devel | sin corrección indicada |
| Red Hat | librbd-devel | sin corrección indicada |
| Red Hat | librbd1 | sin corrección indicada |
| Red Hat | lodash | sin corrección indicada |
| Red Hat | openshift-service-mesh/kiali-ossmc-rhel8 | sin corrección indicada |
| Red Hat | openshift-service-mesh/kiali-rhel8 | sin corrección indicada |
| Red Hat | openshift4/nmstate-console-plugin-rhel9 | sin corrección indicada |
| Red Hat | openshift4/ose-agent-installer-ui-rhel9 | sin corrección indicada |
| Red Hat | openshift4/ose-console | sin corrección indicada |
| Red Hat | openshift4/ose-console-rhel9 | sin corrección indicada |
| Red Hat | openshift4/ose-networking-console-plugin-rhel9 | sin corrección indicada |
| Red Hat | pcs | sin corrección indicada |
| Red Hat | pcs-snmp | sin corrección indicada |
| Red Hat | rhsm-icons | sin corrección indicada |
| Red Hat | satellite/iop-advisor-frontend-rhel9 | sin corrección indicada |
| Red Hat | satellite/iop-host-inventory-frontend-rhel9 | sin corrección indicada |
| Red Hat | satellite/iop-remediations-rhel9 | sin corrección indicada |
| Red Hat | satellite/iop-vulnerability-frontend-rhel9 | sin corrección indicada |
| Red Hat | subscription-manager-cockpit | sin corrección indicada |
| rocky 10 | cockpit-image-builder | 94.3-1.el10_2 |
| seal npm::Seal Security Database | @seal-security/lodash | 4.16.6-sp999, 4.17.11-sp999, 4.17.15-sp2, 4.17.5-sp999 |
| seal npm::Seal Security Database | @seal-security/lodash-es | 4.17.15-sp2 |
| seal npm::Seal Security Database | @seal-security/lodash.template | 4.5.0-sp2 |
| seal npm::Seal Security Database | lodash | 4.16.6-sp999, 4.17.11-sp999, 4.17.15-sp2, 4.17.5-sp999 |
| seal npm::Seal Security Database | lodash-es | 4.17.15-sp2 |
| seal npm::Seal Security Database | lodash.template | 4.5.0-sp2 |
| ubuntu 18.04-ESM | node-lodash | 4.17.4+dfsg-1ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | node-lodash | 4.17.15+dfsg-2ubuntu0.1~esm1 |
| ubuntu 22.04 | node-lodash | sin corrección indicada |
| ubuntu 24.04 | node-lodash | sin corrección indicada |
| ubuntu 25.10 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 |
| ubuntu 26.04 | node-lodash | sin corrección indicada |
| wolfi | argo-workflows-4.0 | 4.0.4-r0 |
| wolfi | code-server | 4.112.0-r2 |
| wolfi | jitsucom-jitsu | 2.11.0-r19 |
| wolfi | json-server | 0.17.4-r6 |
| wolfi | jupyter-base-notebook | 7.6.3-r2 |
| wolfi | kubeflow-centraldashboard | 1.10.0-r18 |
| wolfi | kubeflow-katib | 0.19.0-r40 |
| wolfi | kubeflow-pipelines | 2.16.0-r11 |
| wolfi | langfuse-3 | 3.164.0-r1 |
| wolfi | npm | 11.12.1-r3 |
| wolfi | opensearch-dashboards-3 | 3.5.0-r15 |
| wolfi | prism | 5.15.6-r2 |
| wolfi | py3-jupyterlab | 4.6.1-r1 |
| wolfi | renovate | 43.104.7-r1 |
| wolfi | saf | 1.6.0-r0 |
| wolfi | sqlpad | 7.5.7-r17 |
| wolfi | ts-patch | 4.0.1-r3 |
| wolfi | vitess-23 | 23.0.3-r12 |
Referencias
- https://access.redhat.com/errata/RHBA-2026:21387
- https://access.redhat.com/errata/RHSA-2026:10131
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:10710
- https://access.redhat.com/errata/RHSA-2026:10713
- https://access.redhat.com/errata/RHSA-2026:11454
- https://access.redhat.com/errata/RHSA-2026:11469
- https://access.redhat.com/errata/RHSA-2026:11470
Las 97 referencias
- https://access.redhat.com/errata/RHSA-2026:11471
- https://access.redhat.com/errata/RHSA-2026:11493
- https://access.redhat.com/errata/RHSA-2026:11494
- https://access.redhat.com/errata/RHSA-2026:11495
- https://access.redhat.com/errata/RHSA-2026:11516
- https://access.redhat.com/errata/RHSA-2026:12277
- https://access.redhat.com/errata/RHSA-2026:12279
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:13553
- https://access.redhat.com/errata/RHSA-2026:13571
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:14870
- https://access.redhat.com/errata/RHSA-2026:14871
- https://access.redhat.com/errata/RHSA-2026:16874
- https://access.redhat.com/errata/RHSA-2026:17448
- https://access.redhat.com/errata/RHSA-2026:17468
- https://access.redhat.com/errata/RHSA-2026:17469
- https://access.redhat.com/errata/RHSA-2026:17547
- https://access.redhat.com/errata/RHSA-2026:17549
- https://access.redhat.com/errata/RHSA-2026:17550
- https://access.redhat.com/errata/RHSA-2026:17598
- https://access.redhat.com/errata/RHSA-2026:17789
- https://access.redhat.com/errata/RHSA-2026:19008
- https://access.redhat.com/errata/RHSA-2026:19167
- https://access.redhat.com/errata/RHSA-2026:19409
- https://access.redhat.com/errata/RHSA-2026:19410
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:20041
- https://access.redhat.com/errata/RHSA-2026:20042
- https://access.redhat.com/errata/RHSA-2026:20943
- https://access.redhat.com/errata/RHSA-2026:20946
- https://access.redhat.com/errata/RHSA-2026:21658
- https://access.redhat.com/errata/RHSA-2026:22619
- https://access.redhat.com/errata/RHSA-2026:24331
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:29795
- https://access.redhat.com/errata/RHSA-2026:34100
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:36621
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:37186
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40795
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40984
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:41941
- https://access.redhat.com/errata/RHSA-2026:41944
- https://access.redhat.com/errata/RHSA-2026:42078
- https://access.redhat.com/errata/RHSA-2026:44235
- https://access.redhat.com/errata/RHSA-2026:48699
- https://access.redhat.com/errata/RHSA-2026:54188
- https://access.redhat.com/errata/RHSA-2026:56789
- https://access.redhat.com/errata/RHSA-2026:56854
- https://access.redhat.com/errata/RHSA-2026:56912
- https://access.redhat.com/errata/RHSA-2026:59833
- https://access.redhat.com/errata/RHSA-2026:60023
- https://access.redhat.com/errata/RHSA-2026:8483
- https://access.redhat.com/errata/RHSA-2026:8484
- https://access.redhat.com/errata/RHSA-2026:8490
- https://access.redhat.com/errata/RHSA-2026:8491
- https://access.redhat.com/errata/RHSA-2026:8493
- https://access.redhat.com/errata/RHSA-2026:8498
- https://access.redhat.com/errata/RHSA-2026:9385
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/security/cve/CVE-2026-4800
- https://advisory.echohq.com/cve/CVE-2026-4800
- https://bugzilla.redhat.com/2453496
- https://bugzilla.redhat.com/show_bug.cgi?id=2431740
- https://bugzilla.redhat.com/show_bug.cgi?id=2453496
- https://cna.openjsf.org/security-advisories.html
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13465
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4800
- https://errata.almalinux.org/9/ALSA-2026-19167.html
- https://errata.rockylinux.org/RLSA-2026:24331
- https://github.com/advisories/GHSA-35jh-r3h4-6jhm
- https://github.com/advisories/GHSA-r5fr-rjxr-66jc
- https://github.com/lodash/lodash
- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
- https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
- https://linux.oracle.com/cve/CVE-2026-4800.html
- https://linux.oracle.com/errata/ELSA-2026-24331.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-4800
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json
- https://ubuntu.com/security/notices/USN-8411-1
- https://www.cve.org/CVERecord?id=CVE-2026-4800