Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / CVE-2026-4800

kritik

CVE-2026-4800

lodash: lodash: Arbitrary code execution via untrusted input in template imports

Yayın Değişiklik CWE 94
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: GHSA (yüksek), Red Hat (yüksek), AlmaLinux (yüksek), Oracle (yüksek), Rocky Linux (yüksek), Ubuntu (orta).

Açıklama

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
alma 10cockpit-ha-cluster0.12.1-1.el10_1.3
alma 9pcs, pcs-snmp0.11.11-2.el9_8.1
chainguardarangodb-3.11, arangodb-3.12, argo-workflows-3.6 ve 56 tane daha3.11.14.3-r5 ve 57 tane daha
debian 11node-lodash4.17.21+dfsg+~cs8.31.173-1+deb11u1
debian 12node-lodash4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1
debian 13node-lodash4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
debian 14node-lodash4.18.1+dfsg-1
echomoodle-4.5, moodle-5.0, moodle-5.1 ve 3 tane daha4.5.15+e2 ve 5 tane daha
echo npm::Echo OSVlodash, lodash-es4.17.21+echo.1
minimosarangodb-3.11, arangodb-3.12, argo-workflows-3.7 ve 17 tane daha3.11.14.3-r2 ve 13 tane daha
npm::GitHub Security Advisory npmlodash, lodash-amd, lodash-es ve 1 tane daha4.18.0
Oracle Linux 9pcs, pcs-snmp0.11.11-2.el9_8.1
38 kaynaktaki 292 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
alma 10cockpit-ha-cluster0.12.1-1.el10_1.3
alma 9pcs0.11.11-2.el9_8.1
alma 9pcs-snmp0.11.11-2.el9_8.1
chainguardarangodb-3.113.11.14.3-r5
chainguardarangodb-3.123.12.7.2-r5
chainguardargo-workflows-3.63.6.19-r5
chainguardargo-workflows-3.73.7.13-r0
chainguardargo-workflows-4.04.0.4-r0
chainguardcode-server4.112.0-r2
chainguarddrupal-11.311.3.13-r3
chainguardfoxx-cli2.1.1-r6
chainguardgitlab-rails-ce-18.1118.11.13-r0
chainguardgitlab-rails-ce-19.019.0.3-r1
chainguardgitlab-rails-ce-19.119.1.7-r6
chainguardgitlab-rails-ce-19.219.2.5-r2
chainguardgitlab-rails-ce-19.319.3.1-r6
chainguardgitlab-rails-ce-19.519.5.1-r0
chainguardgitlab-rails-ce-fips-18.118.1.6-r15
chainguardgitlab-rails-ce-fips-18.1018.10.8-r8
chainguardgitlab-rails-ce-fips-18.1118.11.12-r2
chainguardgitlab-rails-ce-fips-18.918.9.8-r8
chainguardgitlab-rails-ce-fips-19.019.0.9-r3
chainguardgitlab-rails-ce-fips-19.119.1.1-r1
chainguardjitsucom-jitsu2.11.0-r19
chainguardjson-server0.17.4-r6
chainguardjupyter-base-notebook7.6.3-r2
chainguardkibana-8.178.17.10-r17
chainguardkibana-8.198.19.14-r2
chainguardkibana-9.09.0.8-r19
chainguardkibana-9.19.1.10-r12
chainguardkibana-9.29.2.7-r5
chainguardkibana-9.39.3.3-r4
chainguardkibana-9.49.4.2-r0
chainguardkubeflow-centraldashboard1.10.0-r18
chainguardkubeflow-katib0.19.0-r40
chainguardkubeflow-pipelines2.16.0-r11
chainguardlangfuse-22.95.12-r17
chainguardlangfuse-33.164.0-r1
chainguardlangfuse-fips-22.95.12-r20
chainguardlangfuse-fips-33.164.0-r1
chainguardlibrechat0.8.4-r5
chainguardnpm11.12.1-r3
chainguardopensearch-dashboards-22.19.5-r8
chainguardopensearch-dashboards-2-fips2.19.5-r7
chainguardopensearch-dashboards-33.5.0-r15
chainguardopensearch-dashboards-3-fips3.5.0-r9
chainguardpelias-api7.6.0-r6
chainguardprism5.15.6-r2
chainguardpy3-captum0.9.0-r1
chainguardpy3-jupyterlab4.6.1-r1
chainguardredisinsight3.2.0-r5
chainguardrenovate43.104.7-r1
chainguardsaf1.6.0-r0
chainguardsemaphore2.18.12-r2
chainguardsqlpad7.5.7-r17
chainguardtensorflow-cpu-jupyter2.21.0-r8
chainguardtensorflow-gpu-jupyter0
chainguardts-patch4.0.1-r3
chainguardvitess-2222.0.4-r9
chainguardvitess-2323.0.3-r12
chainguardwazuh-dashboard4.14.4-r1
chainguardwazuh-dashboard-fips4.14.7-r8
debian 11node-lodash4.17.21+dfsg+~cs8.31.173-1+deb11u1
debian 12node-lodash4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1
debian 13node-lodash4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1
debian 14node-lodash4.18.1+dfsg-1
echomoodle-4.54.5.15+e2
echomoodle-5.05.0.11+e2
echomoodle-5.15.1.8+e2
echomoodle-5.25.2.4+e2
echomoodle-5.35.3.0+e2
echonode-lodash4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1
echo npm::Echo OSVlodash4.17.21+echo.1
echo npm::Echo OSVlodash-es4.17.21+echo.1
minimosarangodb-3.113.11.14.3-r2
minimosarangodb-3.123.12.7.1-r1
minimosargo-workflows-3.73.7.13-r0
minimosargo-workflows-fips-3.73.7.13-r0
minimoscube-1.71.7.43-r0
minimosfoxx-cli2.1.1-r1
minimoskibana-8.198.19.16-r0
minimoskibana-9.39.3.5-r0
minimoskibana-9.49.4.2-r0
minimoskubeflow-pipelines-frontend2.17.0-r0
minimosnginx-proxy-manager-22.14.0-r1
minimosopenclaw2026.4.2-r0
minimosopensearch-dashboards-22.19.6-r0
minimosopensearch-dashboards-2-plugin-alerting-dashboards2.19.6.0-r0
minimosopensearch-dashboards-2-plugin-anomaly-detection-dashboards2.19.6.0-r0
minimosopensearch-dashboards-2-plugin-dashboards-flow-framework2.19.6.0-r0
minimosopensearch-dashboards-2-plugin-dashboards-observability2.19.6.0-r0
minimosopensearch-dashboards-2-plugin-security-analytics-dashboards2.19.6.0-r0
minimosopensearch-dashboards-fips-22.19.6-r0
minimosverdaccio6.8.0-r0
npm::GitHub Security Advisory npmlodash4.18.0
npm::GitHub Security Advisory npmlodash-amd4.18.0
npm::GitHub Security Advisory npmlodash-es4.18.0
npm::GitHub Security Advisory npmlodash.template4.18.0
Oracle Linux 9pcs0.11.11-2.el9_8.1
Oracle Linux 9pcs-snmp0.11.11-2.el9_8.1
rapidfort alma 10cockpit0:356.1-1.el10_2
rapidfort alma 10cockpit-bridge0:356.1-1.el10_2
rapidfort alma 10cockpit-doc0:356.1-1.el10_2
rapidfort alma 10cockpit-filesdüzeltme belirtilmemiş
rapidfort alma 10cockpit-image-builder0:94.3-1.el10_2
rapidfort alma 10cockpit-machinesdüzeltme belirtilmemiş
rapidfort alma 10cockpit-packagekit0:356.1-1.el10_2
rapidfort alma 10cockpit-podmandüzeltme belirtilmemiş
rapidfort alma 10cockpit-storaged0:356.1-1.el10_2
rapidfort alma 10cockpit-system0:356.1-1.el10_2
rapidfort alma 10cockpit-ws0:356.1-1.el10_2
rapidfort alma 10cockpit-ws-selinux0:356.1-1.el10_2
rapidfort alma 10librados-develdüzeltme belirtilmemiş
rapidfort alma 10librados2düzeltme belirtilmemiş
rapidfort alma 10libradospp-develdüzeltme belirtilmemiş
rapidfort alma 10librbd-develdüzeltme belirtilmemiş
rapidfort alma 10librbd1düzeltme belirtilmemiş
rapidfort alma 8cockpitdüzeltme belirtilmemiş
rapidfort alma 8cockpit-bridgedüzeltme belirtilmemiş
rapidfort alma 8cockpit-docdüzeltme belirtilmemiş
rapidfort alma 8cockpit-machinesdüzeltme belirtilmemiş
rapidfort alma 8cockpit-packagekitdüzeltme belirtilmemiş
rapidfort alma 8cockpit-storageddüzeltme belirtilmemiş
rapidfort alma 8cockpit-systemdüzeltme belirtilmemiş
rapidfort alma 8cockpit-wsdüzeltme belirtilmemiş
rapidfort alma 9cockpit0:356.1-1.el9_8
rapidfort alma 9cockpit-bridge0:356.1-1.el9_8
rapidfort alma 9cockpit-doc0:356.1-1.el9_8
rapidfort alma 9cockpit-filesdüzeltme belirtilmemiş
rapidfort alma 9cockpit-machinesdüzeltme belirtilmemiş
rapidfort alma 9cockpit-packagekit0:356.1-1.el9_8
rapidfort alma 9cockpit-podmandüzeltme belirtilmemiş
rapidfort alma 9cockpit-storaged0:356.1-1.el9_8
rapidfort alma 9cockpit-system0:356.1-1.el9_8
rapidfort alma 9cockpit-ws0:356.1-1.el9_8
rapidfort alma 9cockpit-ws-selinux0:356.1-1.el9_8
rapidfort alma 9librados-develdüzeltme belirtilmemiş
rapidfort alma 9librados2düzeltme belirtilmemiş
rapidfort alma 9libradospp-develdüzeltme belirtilmemiş
rapidfort alma 9librbd-develdüzeltme belirtilmemiş
rapidfort alma 9librbd1düzeltme belirtilmemiş
rapidfort debian 12node-lodash0:4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1
rapidfort debian 13node-lodash0:4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1
rapidfort fedora 43cockpit-ha-cluster0.12.2-2.fc43
rapidfort fedora 43nextcloud33.0.3-1.fc43
rapidfort fedora 43nextcloud-httpd33.0.3-1.fc43
rapidfort fedora 43nextcloud-mysql33.0.3-1.fc43
rapidfort fedora 43nextcloud-nginx33.0.3-1.fc43
rapidfort fedora 43nextcloud-postgresql33.0.3-1.fc43
rapidfort fedora 43nextcloud-sqlite33.0.3-1.fc43
rapidfort fedora 43pcs0.12.2-2.fc43
rapidfort fedora 43pcs-snmp0.12.2-2.fc43
rapidfort fedora 43pcs-web-ui0.12.2-2.fc43
rapidfort fedora 43pgadmin49.14-1.fc43
rapidfort fedora 43pgadmin4-doc9.14-1.fc43
rapidfort fedora 43pgadmin4-httpd9.14-1.fc43
rapidfort fedora 43pgadmin4-langpack-cs9.14-1.fc43
rapidfort fedora 43pgadmin4-langpack-de9.14-1.fc43
rapidfort fedora 43pgadmin4-langpack-es9.14-1.fc43
rapidfort fedora 43pgadmin4-langpack-fr9.14-1.fc43
rapidfort fedora 43pgadmin4-langpack-it9.14-1.fc43
rapidfort fedora 43pgadmin4-langpack-ja9.14-1.fc43
rapidfort fedora 43pgadmin4-langpack-ko9.14-1.fc43
rapidfort fedora 43pgadmin4-langpack-pl9.14-1.fc43
rapidfort fedora 43pgadmin4-langpack-ru9.14-1.fc43
rapidfort fedora 43pgadmin4-qt9.14-1.fc43
rapidfort fedora 43python-jupytext1.19.1-4.fc43
rapidfort fedora 43python-jupytext-doc1.19.1-4.fc43
rapidfort fedora 43python3-jupyterlab-jupytext1.19.1-4.fc43
rapidfort fedora 43python3-jupytext1.19.1-4.fc43
rapidfort fedora 43yarnpkg1.22.22-18.fc43
rapidfort Oracle Linux 10cockpit0:356.1-1.el10_2
rapidfort Oracle Linux 10cockpit-bridge0:356.1-1.el10_2
rapidfort Oracle Linux 10cockpit-doc0:356.1-1.el10_2
rapidfort Oracle Linux 10cockpit-filesdüzeltme belirtilmemiş
rapidfort Oracle Linux 10cockpit-ha-cluster0:0.12.2-3.el10_2.1
rapidfort Oracle Linux 10cockpit-image-builder0:94.3-1.0.1.el10_2
rapidfort Oracle Linux 10cockpit-machinesdüzeltme belirtilmemiş
rapidfort Oracle Linux 10cockpit-packagekit0:356.1-1.el10_2
rapidfort Oracle Linux 10cockpit-storaged0:356.1-1.el10_2
rapidfort Oracle Linux 10cockpit-system0:356.1-1.el10_2
rapidfort Oracle Linux 10cockpit-ws0:356.1-1.el10_2
rapidfort Oracle Linux 10cockpit-ws-selinux0:356.1-1.el10_2
rapidfort Oracle Linux 10nextcloud33.0.3-1.el10_3
rapidfort Oracle Linux 10nextcloud-httpd33.0.3-1.el10_3
rapidfort Oracle Linux 10nextcloud-mysql33.0.3-1.el10_3
rapidfort Oracle Linux 10nextcloud-nginx33.0.3-1.el10_3
rapidfort Oracle Linux 10nextcloud-postgresql33.0.3-1.el10_3
rapidfort Oracle Linux 10nextcloud-sqlite33.0.3-1.el10_3
rapidfort Oracle Linux 10pcs0:0.12.2-3.el10_2.1
rapidfort Oracle Linux 10pcs-snmp0:0.12.2-3.el10_2.1
rapidfort Oracle Linux 10yarnpkg1.22.22-18.el10_3
rapidfort Oracle Linux 9cockpit0:356.1-1.el9_8
rapidfort Oracle Linux 9cockpit-bridge0:356.1-1.el9_8
rapidfort Oracle Linux 9cockpit-doc0:356.1-1.el9_8
rapidfort Oracle Linux 9cockpit-filesdüzeltme belirtilmemiş
rapidfort Oracle Linux 9cockpit-machinesdüzeltme belirtilmemiş
rapidfort Oracle Linux 9cockpit-packagekit0:356.1-1.el9_8
rapidfort Oracle Linux 9cockpit-storaged0:356.1-1.el9_8
rapidfort Oracle Linux 9cockpit-system0:356.1-1.el9_8
rapidfort Oracle Linux 9cockpit-ws0:356.1-1.el9_8
rapidfort Oracle Linux 9cockpit-ws-selinux0:356.1-1.el9_8
rapidfort Oracle Linux 9pcs0:0.11.11-2.el9_8.1
rapidfort Oracle Linux 9pcs-snmp0:0.11.11-2.el9_8.1
rapidfort Oracle Linux 9yarnpkg1.22.22-18.el9
rapidfort Red Hat 10cockpit-podmandüzeltme belirtilmemiş
rapidfort Red Hat 9cockpit-podmandüzeltme belirtilmemiş
rapidfort rocky 10cockpit-filesdüzeltme belirtilmemiş
rapidfort rocky 10cockpit-machinesdüzeltme belirtilmemiş
rapidfort rocky 10cockpit-podmandüzeltme belirtilmemiş
rapidfort rocky 8cockpitdüzeltme belirtilmemiş
rapidfort rocky 8cockpit-bridgedüzeltme belirtilmemiş
rapidfort rocky 8cockpit-machinesdüzeltme belirtilmemiş
rapidfort rocky 8cockpit-wsdüzeltme belirtilmemiş
rapidfort rocky 9cockpit0:356.1-1.el9_8
rapidfort rocky 9cockpit-bridge0:356.1-1.el9_8
rapidfort rocky 9cockpit-filesdüzeltme belirtilmemiş
rapidfort rocky 9cockpit-machinesdüzeltme belirtilmemiş
rapidfort rocky 9cockpit-podmandüzeltme belirtilmemiş
rapidfort rocky 9cockpit-ws0:356.1-1.el9_8
rapidfort rocky 9cockpit-ws-selinux0:356.1-1.el9_8
rapidfort ubuntu 20.04node-lodash0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3
rapidfort ubuntu 20.04rf-node-lodash0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3
rapidfort ubuntu 22.04node-lodash0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3
rapidfort ubuntu 22.04rf-node-lodash0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3
rapidfort ubuntu 24.04node-lodash0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3
rapidfort ubuntu 24.04rf-node-lodash0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3
Red Hatcockpitdüzeltme belirtilmemiş
Red Hatcockpit-bridgedüzeltme belirtilmemiş
Red Hatcockpit-dashboarddüzeltme belirtilmemiş
Red Hatcockpit-docdüzeltme belirtilmemiş
Red Hatcockpit-filesdüzeltme belirtilmemiş
Red Hatcockpit-machinesdüzeltme belirtilmemiş
Red Hatcockpit-packagekitdüzeltme belirtilmemiş
Red Hatcockpit-pcpdüzeltme belirtilmemiş
Red Hatcockpit-podmandüzeltme belirtilmemiş
Red Hatcockpit-storageddüzeltme belirtilmemiş
Red Hatcockpit-systemdüzeltme belirtilmemiş
Red Hatcockpit-wsdüzeltme belirtilmemiş
Red Hatcontainer-tools:rhel8::cockpit-podmandüzeltme belirtilmemiş
Red Hatlibrados-develdüzeltme belirtilmemiş
Red Hatlibrados2düzeltme belirtilmemiş
Red Hatlibradospp-develdüzeltme belirtilmemiş
Red Hatlibrbd-develdüzeltme belirtilmemiş
Red Hatlibrbd1düzeltme belirtilmemiş
Red Hatlodashdüzeltme belirtilmemiş
Red Hatopenshift-service-mesh/kiali-ossmc-rhel8düzeltme belirtilmemiş
Red Hatopenshift-service-mesh/kiali-rhel8düzeltme belirtilmemiş
Red Hatopenshift4/nmstate-console-plugin-rhel9düzeltme belirtilmemiş
Red Hatopenshift4/ose-agent-installer-ui-rhel9düzeltme belirtilmemiş
Red Hatopenshift4/ose-consoledüzeltme belirtilmemiş
Red Hatopenshift4/ose-console-rhel9düzeltme belirtilmemiş
Red Hatopenshift4/ose-networking-console-plugin-rhel9düzeltme belirtilmemiş
Red Hatpcsdüzeltme belirtilmemiş
Red Hatpcs-snmpdüzeltme belirtilmemiş
Red Hatrhsm-iconsdüzeltme belirtilmemiş
Red Hatsatellite/iop-advisor-frontend-rhel9düzeltme belirtilmemiş
Red Hatsatellite/iop-host-inventory-frontend-rhel9düzeltme belirtilmemiş
Red Hatsatellite/iop-remediations-rhel9düzeltme belirtilmemiş
Red Hatsatellite/iop-vulnerability-frontend-rhel9düzeltme belirtilmemiş
Red Hatsubscription-manager-cockpitdüzeltme belirtilmemiş
rocky 10cockpit-image-builder94.3-1.el10_2
seal npm::Seal Security Database@seal-security/lodash4.16.6-sp999, 4.17.11-sp999, 4.17.15-sp2, 4.17.5-sp999
seal npm::Seal Security Database@seal-security/lodash-es4.17.15-sp2
seal npm::Seal Security Database@seal-security/lodash.template4.5.0-sp2
seal npm::Seal Security Databaselodash4.16.6-sp999, 4.17.11-sp999, 4.17.15-sp2, 4.17.5-sp999
seal npm::Seal Security Databaselodash-es4.17.15-sp2
seal npm::Seal Security Databaselodash.template4.5.0-sp2
ubuntu 18.04-ESMnode-lodash4.17.4+dfsg-1ubuntu0.1~esm1
ubuntu 20.04-ESMnode-lodash4.17.15+dfsg-2ubuntu0.1~esm1
ubuntu 22.04node-lodashdüzeltme belirtilmemiş
ubuntu 24.04node-lodashdüzeltme belirtilmemiş
ubuntu 25.10node-lodash4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1
ubuntu 26.04node-lodashdüzeltme belirtilmemiş
wolfiargo-workflows-4.04.0.4-r0
wolficode-server4.112.0-r2
wolfijitsucom-jitsu2.11.0-r19
wolfijson-server0.17.4-r6
wolfijupyter-base-notebook7.6.3-r2
wolfikubeflow-centraldashboard1.10.0-r18
wolfikubeflow-katib0.19.0-r40
wolfikubeflow-pipelines2.16.0-r11
wolfilangfuse-33.164.0-r1
wolfinpm11.12.1-r3
wolfiopensearch-dashboards-33.5.0-r15
wolfiprism5.15.6-r2
wolfipy3-jupyterlab4.6.1-r1
wolfirenovate43.104.7-r1
wolfisaf1.6.0-r0
wolfisqlpad7.5.7-r17
wolfits-patch4.0.1-r3
wolfivitess-2323.0.3-r12

Referanslar

97 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.