critical
CVE-2026-4800
lodash: lodash: Arbitrary code execution via untrusted input in template imports
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high), AlmaLinux (high), Oracle (high), Rocky Linux (high), Ubuntu (medium).
Description
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alma 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.3 |
| alma 9 | pcs, pcs-snmp | 0.11.11-2.el9_8.1 |
| chainguard | arangodb-3.11, arangodb-3.12, argo-workflows-3.6 and 56 more | 3.11.14.3-r5 and 57 more |
| debian 11 | node-lodash | 4.17.21+dfsg+~cs8.31.173-1+deb11u1 |
| debian 12 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| debian 13 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 |
| debian 14 | node-lodash | 4.18.1+dfsg-1 |
| echo | moodle-4.5, moodle-5.0, moodle-5.1 and 3 more | 4.5.15+e2 and 5 more |
| echo npm::Echo OSV | lodash, lodash-es | 4.17.21+echo.1 |
| minimos | arangodb-3.11, arangodb-3.12, argo-workflows-3.7 and 17 more | 3.11.14.3-r2 and 13 more |
| npm::GitHub Security Advisory npm | lodash, lodash-amd, lodash-es and 1 more | 4.18.0 |
| Oracle Linux 9 | pcs, pcs-snmp | 0.11.11-2.el9_8.1 |
Show all 292 entries from 38 sources
| Source | Package | Fixed in |
|---|---|---|
| alma 10 | cockpit-ha-cluster | 0.12.1-1.el10_1.3 |
| alma 9 | pcs | 0.11.11-2.el9_8.1 |
| alma 9 | pcs-snmp | 0.11.11-2.el9_8.1 |
| chainguard | arangodb-3.11 | 3.11.14.3-r5 |
| chainguard | arangodb-3.12 | 3.12.7.2-r5 |
| chainguard | argo-workflows-3.6 | 3.6.19-r5 |
| chainguard | argo-workflows-3.7 | 3.7.13-r0 |
| chainguard | argo-workflows-4.0 | 4.0.4-r0 |
| chainguard | code-server | 4.112.0-r2 |
| chainguard | drupal-11.3 | 11.3.13-r3 |
| chainguard | foxx-cli | 2.1.1-r6 |
| chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| chainguard | gitlab-rails-ce-19.0 | 19.0.3-r1 |
| chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| chainguard | gitlab-rails-ce-19.5 | 19.5.1-r0 |
| chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r15 |
| chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| chainguard | gitlab-rails-ce-fips-19.1 | 19.1.1-r1 |
| chainguard | jitsucom-jitsu | 2.11.0-r19 |
| chainguard | json-server | 0.17.4-r6 |
| chainguard | jupyter-base-notebook | 7.6.3-r2 |
| chainguard | kibana-8.17 | 8.17.10-r17 |
| chainguard | kibana-8.19 | 8.19.14-r2 |
| chainguard | kibana-9.0 | 9.0.8-r19 |
| chainguard | kibana-9.1 | 9.1.10-r12 |
| chainguard | kibana-9.2 | 9.2.7-r5 |
| chainguard | kibana-9.3 | 9.3.3-r4 |
| chainguard | kibana-9.4 | 9.4.2-r0 |
| chainguard | kubeflow-centraldashboard | 1.10.0-r18 |
| chainguard | kubeflow-katib | 0.19.0-r40 |
| chainguard | kubeflow-pipelines | 2.16.0-r11 |
| chainguard | langfuse-2 | 2.95.12-r17 |
| chainguard | langfuse-3 | 3.164.0-r1 |
| chainguard | langfuse-fips-2 | 2.95.12-r20 |
| chainguard | langfuse-fips-3 | 3.164.0-r1 |
| chainguard | librechat | 0.8.4-r5 |
| chainguard | npm | 11.12.1-r3 |
| chainguard | opensearch-dashboards-2 | 2.19.5-r8 |
| chainguard | opensearch-dashboards-2-fips | 2.19.5-r7 |
| chainguard | opensearch-dashboards-3 | 3.5.0-r15 |
| chainguard | opensearch-dashboards-3-fips | 3.5.0-r9 |
| chainguard | pelias-api | 7.6.0-r6 |
| chainguard | prism | 5.15.6-r2 |
| chainguard | py3-captum | 0.9.0-r1 |
| chainguard | py3-jupyterlab | 4.6.1-r1 |
| chainguard | redisinsight | 3.2.0-r5 |
| chainguard | renovate | 43.104.7-r1 |
| chainguard | saf | 1.6.0-r0 |
| chainguard | semaphore | 2.18.12-r2 |
| chainguard | sqlpad | 7.5.7-r17 |
| chainguard | tensorflow-cpu-jupyter | 2.21.0-r8 |
| chainguard | tensorflow-gpu-jupyter | 0 |
| chainguard | ts-patch | 4.0.1-r3 |
| chainguard | vitess-22 | 22.0.4-r9 |
| chainguard | vitess-23 | 23.0.3-r12 |
| chainguard | wazuh-dashboard | 4.14.4-r1 |
| chainguard | wazuh-dashboard-fips | 4.14.7-r8 |
| debian 11 | node-lodash | 4.17.21+dfsg+~cs8.31.173-1+deb11u1 |
| debian 12 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| debian 13 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb13u1 |
| debian 14 | node-lodash | 4.18.1+dfsg-1 |
| echo | moodle-4.5 | 4.5.15+e2 |
| echo | moodle-5.0 | 5.0.11+e2 |
| echo | moodle-5.1 | 5.1.8+e2 |
| echo | moodle-5.2 | 5.2.4+e2 |
| echo | moodle-5.3 | 5.3.0+e2 |
| echo | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| echo npm::Echo OSV | lodash | 4.17.21+echo.1 |
| echo npm::Echo OSV | lodash-es | 4.17.21+echo.1 |
| minimos | arangodb-3.11 | 3.11.14.3-r2 |
| minimos | arangodb-3.12 | 3.12.7.1-r1 |
| minimos | argo-workflows-3.7 | 3.7.13-r0 |
| minimos | argo-workflows-fips-3.7 | 3.7.13-r0 |
| minimos | cube-1.7 | 1.7.43-r0 |
| minimos | foxx-cli | 2.1.1-r1 |
| minimos | kibana-8.19 | 8.19.16-r0 |
| minimos | kibana-9.3 | 9.3.5-r0 |
| minimos | kibana-9.4 | 9.4.2-r0 |
| minimos | kubeflow-pipelines-frontend | 2.17.0-r0 |
| minimos | nginx-proxy-manager-2 | 2.14.0-r1 |
| minimos | openclaw | 2026.4.2-r0 |
| minimos | opensearch-dashboards-2 | 2.19.6-r0 |
| minimos | opensearch-dashboards-2-plugin-alerting-dashboards | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-anomaly-detection-dashboards | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-dashboards-flow-framework | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-dashboards-observability | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-2-plugin-security-analytics-dashboards | 2.19.6.0-r0 |
| minimos | opensearch-dashboards-fips-2 | 2.19.6-r0 |
| minimos | verdaccio | 6.8.0-r0 |
| npm::GitHub Security Advisory npm | lodash | 4.18.0 |
| npm::GitHub Security Advisory npm | lodash-amd | 4.18.0 |
| npm::GitHub Security Advisory npm | lodash-es | 4.18.0 |
| npm::GitHub Security Advisory npm | lodash.template | 4.18.0 |
| Oracle Linux 9 | pcs | 0.11.11-2.el9_8.1 |
| Oracle Linux 9 | pcs-snmp | 0.11.11-2.el9_8.1 |
| rapidfort alma 10 | cockpit | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-bridge | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-doc | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-files | no fix listed |
| rapidfort alma 10 | cockpit-image-builder | 0:94.3-1.el10_2 |
| rapidfort alma 10 | cockpit-machines | no fix listed |
| rapidfort alma 10 | cockpit-packagekit | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-podman | no fix listed |
| rapidfort alma 10 | cockpit-storaged | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-system | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-ws | 0:356.1-1.el10_2 |
| rapidfort alma 10 | cockpit-ws-selinux | 0:356.1-1.el10_2 |
| rapidfort alma 10 | librados-devel | no fix listed |
| rapidfort alma 10 | librados2 | no fix listed |
| rapidfort alma 10 | libradospp-devel | no fix listed |
| rapidfort alma 10 | librbd-devel | no fix listed |
| rapidfort alma 10 | librbd1 | no fix listed |
| rapidfort alma 8 | cockpit | no fix listed |
| rapidfort alma 8 | cockpit-bridge | no fix listed |
| rapidfort alma 8 | cockpit-doc | no fix listed |
| rapidfort alma 8 | cockpit-machines | no fix listed |
| rapidfort alma 8 | cockpit-packagekit | no fix listed |
| rapidfort alma 8 | cockpit-storaged | no fix listed |
| rapidfort alma 8 | cockpit-system | no fix listed |
| rapidfort alma 8 | cockpit-ws | no fix listed |
| rapidfort alma 9 | cockpit | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-bridge | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-doc | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-files | no fix listed |
| rapidfort alma 9 | cockpit-machines | no fix listed |
| rapidfort alma 9 | cockpit-packagekit | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-podman | no fix listed |
| rapidfort alma 9 | cockpit-storaged | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-system | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-ws | 0:356.1-1.el9_8 |
| rapidfort alma 9 | cockpit-ws-selinux | 0:356.1-1.el9_8 |
| rapidfort alma 9 | librados-devel | no fix listed |
| rapidfort alma 9 | librados2 | no fix listed |
| rapidfort alma 9 | libradospp-devel | no fix listed |
| rapidfort alma 9 | librbd-devel | no fix listed |
| rapidfort alma 9 | librbd1 | no fix listed |
| rapidfort debian 12 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| rapidfort debian 13 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1 |
| rapidfort fedora 43 | cockpit-ha-cluster | 0.12.2-2.fc43 |
| rapidfort fedora 43 | nextcloud | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-httpd | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-mysql | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-nginx | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-postgresql | 33.0.3-1.fc43 |
| rapidfort fedora 43 | nextcloud-sqlite | 33.0.3-1.fc43 |
| rapidfort fedora 43 | pcs | 0.12.2-2.fc43 |
| rapidfort fedora 43 | pcs-snmp | 0.12.2-2.fc43 |
| rapidfort fedora 43 | pcs-web-ui | 0.12.2-2.fc43 |
| rapidfort fedora 43 | pgadmin4 | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-doc | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-httpd | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-cs | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-de | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-es | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-fr | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-it | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-ja | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-ko | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-pl | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-langpack-ru | 9.14-1.fc43 |
| rapidfort fedora 43 | pgadmin4-qt | 9.14-1.fc43 |
| rapidfort fedora 43 | python-jupytext | 1.19.1-4.fc43 |
| rapidfort fedora 43 | python-jupytext-doc | 1.19.1-4.fc43 |
| rapidfort fedora 43 | python3-jupyterlab-jupytext | 1.19.1-4.fc43 |
| rapidfort fedora 43 | python3-jupytext | 1.19.1-4.fc43 |
| rapidfort fedora 43 | yarnpkg | 1.22.22-18.fc43 |
| rapidfort Oracle Linux 10 | cockpit | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-bridge | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-doc | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-files | no fix listed |
| rapidfort Oracle Linux 10 | cockpit-ha-cluster | 0:0.12.2-3.el10_2.1 |
| rapidfort Oracle Linux 10 | cockpit-image-builder | 0:94.3-1.0.1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-machines | no fix listed |
| rapidfort Oracle Linux 10 | cockpit-packagekit | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-storaged | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-system | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-ws | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | cockpit-ws-selinux | 0:356.1-1.el10_2 |
| rapidfort Oracle Linux 10 | nextcloud | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-httpd | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-mysql | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-nginx | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-postgresql | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | nextcloud-sqlite | 33.0.3-1.el10_3 |
| rapidfort Oracle Linux 10 | pcs | 0:0.12.2-3.el10_2.1 |
| rapidfort Oracle Linux 10 | pcs-snmp | 0:0.12.2-3.el10_2.1 |
| rapidfort Oracle Linux 10 | yarnpkg | 1.22.22-18.el10_3 |
| rapidfort Oracle Linux 9 | cockpit | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-bridge | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-doc | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-files | no fix listed |
| rapidfort Oracle Linux 9 | cockpit-machines | no fix listed |
| rapidfort Oracle Linux 9 | cockpit-packagekit | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-storaged | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-system | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-ws | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | cockpit-ws-selinux | 0:356.1-1.el9_8 |
| rapidfort Oracle Linux 9 | pcs | 0:0.11.11-2.el9_8.1 |
| rapidfort Oracle Linux 9 | pcs-snmp | 0:0.11.11-2.el9_8.1 |
| rapidfort Oracle Linux 9 | yarnpkg | 1.22.22-18.el9 |
| rapidfort Red Hat 10 | cockpit-podman | no fix listed |
| rapidfort Red Hat 9 | cockpit-podman | no fix listed |
| rapidfort rocky 10 | cockpit-files | no fix listed |
| rapidfort rocky 10 | cockpit-machines | no fix listed |
| rapidfort rocky 10 | cockpit-podman | no fix listed |
| rapidfort rocky 8 | cockpit | no fix listed |
| rapidfort rocky 8 | cockpit-bridge | no fix listed |
| rapidfort rocky 8 | cockpit-machines | no fix listed |
| rapidfort rocky 8 | cockpit-ws | no fix listed |
| rapidfort rocky 9 | cockpit | 0:356.1-1.el9_8 |
| rapidfort rocky 9 | cockpit-bridge | 0:356.1-1.el9_8 |
| rapidfort rocky 9 | cockpit-files | no fix listed |
| rapidfort rocky 9 | cockpit-machines | no fix listed |
| rapidfort rocky 9 | cockpit-podman | no fix listed |
| rapidfort rocky 9 | cockpit-ws | 0:356.1-1.el9_8 |
| rapidfort rocky 9 | cockpit-ws-selinux | 0:356.1-1.el9_8 |
| rapidfort ubuntu 20.04 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 20.04 | rf-node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 22.04 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 22.04 | rf-node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 24.04 | node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| rapidfort ubuntu 24.04 | rf-node-lodash | 0:4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, 0:4.18.1+dfsg-3 |
| Red Hat | cockpit | no fix listed |
| Red Hat | cockpit-bridge | no fix listed |
| Red Hat | cockpit-dashboard | no fix listed |
| Red Hat | cockpit-doc | no fix listed |
| Red Hat | cockpit-files | no fix listed |
| Red Hat | cockpit-machines | no fix listed |
| Red Hat | cockpit-packagekit | no fix listed |
| Red Hat | cockpit-pcp | no fix listed |
| Red Hat | cockpit-podman | no fix listed |
| Red Hat | cockpit-storaged | no fix listed |
| Red Hat | cockpit-system | no fix listed |
| Red Hat | cockpit-ws | no fix listed |
| Red Hat | container-tools:rhel8::cockpit-podman | no fix listed |
| Red Hat | librados-devel | no fix listed |
| Red Hat | librados2 | no fix listed |
| Red Hat | libradospp-devel | no fix listed |
| Red Hat | librbd-devel | no fix listed |
| Red Hat | librbd1 | no fix listed |
| Red Hat | lodash | no fix listed |
| Red Hat | openshift-service-mesh/kiali-ossmc-rhel8 | no fix listed |
| Red Hat | openshift-service-mesh/kiali-rhel8 | no fix listed |
| Red Hat | openshift4/nmstate-console-plugin-rhel9 | no fix listed |
| Red Hat | openshift4/ose-agent-installer-ui-rhel9 | no fix listed |
| Red Hat | openshift4/ose-console | no fix listed |
| Red Hat | openshift4/ose-console-rhel9 | no fix listed |
| Red Hat | openshift4/ose-networking-console-plugin-rhel9 | no fix listed |
| Red Hat | pcs | no fix listed |
| Red Hat | pcs-snmp | no fix listed |
| Red Hat | rhsm-icons | no fix listed |
| Red Hat | satellite/iop-advisor-frontend-rhel9 | no fix listed |
| Red Hat | satellite/iop-host-inventory-frontend-rhel9 | no fix listed |
| Red Hat | satellite/iop-remediations-rhel9 | no fix listed |
| Red Hat | satellite/iop-vulnerability-frontend-rhel9 | no fix listed |
| Red Hat | subscription-manager-cockpit | no fix listed |
| rocky 10 | cockpit-image-builder | 94.3-1.el10_2 |
| seal npm::Seal Security Database | @seal-security/lodash | 4.16.6-sp999, 4.17.11-sp999, 4.17.15-sp2, 4.17.5-sp999 |
| seal npm::Seal Security Database | @seal-security/lodash-es | 4.17.15-sp2 |
| seal npm::Seal Security Database | @seal-security/lodash.template | 4.5.0-sp2 |
| seal npm::Seal Security Database | lodash | 4.16.6-sp999, 4.17.11-sp999, 4.17.15-sp2, 4.17.5-sp999 |
| seal npm::Seal Security Database | lodash-es | 4.17.15-sp2 |
| seal npm::Seal Security Database | lodash.template | 4.5.0-sp2 |
| ubuntu 18.04-ESM | node-lodash | 4.17.4+dfsg-1ubuntu0.1~esm1 |
| ubuntu 20.04-ESM | node-lodash | 4.17.15+dfsg-2ubuntu0.1~esm1 |
| ubuntu 22.04 | node-lodash | no fix listed |
| ubuntu 24.04 | node-lodash | no fix listed |
| ubuntu 25.10 | node-lodash | 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1 |
| ubuntu 26.04 | node-lodash | no fix listed |
| wolfi | argo-workflows-4.0 | 4.0.4-r0 |
| wolfi | code-server | 4.112.0-r2 |
| wolfi | jitsucom-jitsu | 2.11.0-r19 |
| wolfi | json-server | 0.17.4-r6 |
| wolfi | jupyter-base-notebook | 7.6.3-r2 |
| wolfi | kubeflow-centraldashboard | 1.10.0-r18 |
| wolfi | kubeflow-katib | 0.19.0-r40 |
| wolfi | kubeflow-pipelines | 2.16.0-r11 |
| wolfi | langfuse-3 | 3.164.0-r1 |
| wolfi | npm | 11.12.1-r3 |
| wolfi | opensearch-dashboards-3 | 3.5.0-r15 |
| wolfi | prism | 5.15.6-r2 |
| wolfi | py3-jupyterlab | 4.6.1-r1 |
| wolfi | renovate | 43.104.7-r1 |
| wolfi | saf | 1.6.0-r0 |
| wolfi | sqlpad | 7.5.7-r17 |
| wolfi | ts-patch | 4.0.1-r3 |
| wolfi | vitess-23 | 23.0.3-r12 |
References
- https://access.redhat.com/errata/RHBA-2026:21387
- https://access.redhat.com/errata/RHSA-2026:10131
- https://access.redhat.com/errata/RHSA-2026:10175
- https://access.redhat.com/errata/RHSA-2026:10710
- https://access.redhat.com/errata/RHSA-2026:10713
- https://access.redhat.com/errata/RHSA-2026:11454
- https://access.redhat.com/errata/RHSA-2026:11469
- https://access.redhat.com/errata/RHSA-2026:11470
All 97 references
- https://access.redhat.com/errata/RHSA-2026:11471
- https://access.redhat.com/errata/RHSA-2026:11493
- https://access.redhat.com/errata/RHSA-2026:11494
- https://access.redhat.com/errata/RHSA-2026:11495
- https://access.redhat.com/errata/RHSA-2026:11516
- https://access.redhat.com/errata/RHSA-2026:12277
- https://access.redhat.com/errata/RHSA-2026:12279
- https://access.redhat.com/errata/RHSA-2026:13545
- https://access.redhat.com/errata/RHSA-2026:13553
- https://access.redhat.com/errata/RHSA-2026:13571
- https://access.redhat.com/errata/RHSA-2026:13826
- https://access.redhat.com/errata/RHSA-2026:14870
- https://access.redhat.com/errata/RHSA-2026:14871
- https://access.redhat.com/errata/RHSA-2026:16874
- https://access.redhat.com/errata/RHSA-2026:17448
- https://access.redhat.com/errata/RHSA-2026:17468
- https://access.redhat.com/errata/RHSA-2026:17469
- https://access.redhat.com/errata/RHSA-2026:17547
- https://access.redhat.com/errata/RHSA-2026:17549
- https://access.redhat.com/errata/RHSA-2026:17550
- https://access.redhat.com/errata/RHSA-2026:17598
- https://access.redhat.com/errata/RHSA-2026:17789
- https://access.redhat.com/errata/RHSA-2026:19008
- https://access.redhat.com/errata/RHSA-2026:19167
- https://access.redhat.com/errata/RHSA-2026:19409
- https://access.redhat.com/errata/RHSA-2026:19410
- https://access.redhat.com/errata/RHSA-2026:19712
- https://access.redhat.com/errata/RHSA-2026:20041
- https://access.redhat.com/errata/RHSA-2026:20042
- https://access.redhat.com/errata/RHSA-2026:20943
- https://access.redhat.com/errata/RHSA-2026:20946
- https://access.redhat.com/errata/RHSA-2026:21658
- https://access.redhat.com/errata/RHSA-2026:22619
- https://access.redhat.com/errata/RHSA-2026:24331
- https://access.redhat.com/errata/RHSA-2026:24762
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:29795
- https://access.redhat.com/errata/RHSA-2026:34100
- https://access.redhat.com/errata/RHSA-2026:34342
- https://access.redhat.com/errata/RHSA-2026:34608
- https://access.redhat.com/errata/RHSA-2026:36621
- https://access.redhat.com/errata/RHSA-2026:36651
- https://access.redhat.com/errata/RHSA-2026:37186
- https://access.redhat.com/errata/RHSA-2026:40118
- https://access.redhat.com/errata/RHSA-2026:40795
- https://access.redhat.com/errata/RHSA-2026:40945
- https://access.redhat.com/errata/RHSA-2026:40984
- https://access.redhat.com/errata/RHSA-2026:41928
- https://access.redhat.com/errata/RHSA-2026:41941
- https://access.redhat.com/errata/RHSA-2026:41944
- https://access.redhat.com/errata/RHSA-2026:42078
- https://access.redhat.com/errata/RHSA-2026:44235
- https://access.redhat.com/errata/RHSA-2026:48699
- https://access.redhat.com/errata/RHSA-2026:54188
- https://access.redhat.com/errata/RHSA-2026:56789
- https://access.redhat.com/errata/RHSA-2026:56854
- https://access.redhat.com/errata/RHSA-2026:56912
- https://access.redhat.com/errata/RHSA-2026:59833
- https://access.redhat.com/errata/RHSA-2026:60023
- https://access.redhat.com/errata/RHSA-2026:8483
- https://access.redhat.com/errata/RHSA-2026:8484
- https://access.redhat.com/errata/RHSA-2026:8490
- https://access.redhat.com/errata/RHSA-2026:8491
- https://access.redhat.com/errata/RHSA-2026:8493
- https://access.redhat.com/errata/RHSA-2026:8498
- https://access.redhat.com/errata/RHSA-2026:9385
- https://access.redhat.com/errata/RHSA-2026:9742
- https://access.redhat.com/security/cve/CVE-2026-4800
- https://advisory.echohq.com/cve/CVE-2026-4800
- https://bugzilla.redhat.com/2453496
- https://bugzilla.redhat.com/show_bug.cgi?id=2431740
- https://bugzilla.redhat.com/show_bug.cgi?id=2453496
- https://cna.openjsf.org/security-advisories.html
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13465
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4800
- https://errata.almalinux.org/9/ALSA-2026-19167.html
- https://errata.rockylinux.org/RLSA-2026:24331
- https://github.com/advisories/GHSA-35jh-r3h4-6jhm
- https://github.com/advisories/GHSA-r5fr-rjxr-66jc
- https://github.com/lodash/lodash
- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
- https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
- https://linux.oracle.com/cve/CVE-2026-4800.html
- https://linux.oracle.com/errata/ELSA-2026-24331.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-4800
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-4800.json
- https://ubuntu.com/security/notices/USN-8411-1
- https://www.cve.org/CVERecord?id=CVE-2026-4800