Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports…

High CVSS 8.1

CVECVE-2026-4800

First seen2026-07-15 14:16 UTC

Disclosed2026-03-31 20:16 UTC

Last updated2026-07-21 14:16 UTC

Channel statusauto

Summary

Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith …

In-depth triage · Auto channel

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Affected products

Lint boundary warnings (1)

The following non-blocking warnings were raised during the lint phase of this triage (e.g. reference URLs not yet on the allowlist). They do not affect entry usability and are disclosed for transparency (see DR-002).

REF_URL_NOT_ALLOWLISTED url not in allowlist: https://cna.openjsf.org/security-advisories.html

Impact: The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports…

Summary

In-depth triage · Auto channel

Affected products

Sources

Original Links

Timeline