IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
8.1Hoch

CVE-2026-4800lodash vulnerable to Code Injection via `_.template` imports key names

lodash lodash; lodash lodash-es; lodash lodash-amd; lodash lodash.template Veröffentlicht: (vor 7 Monaten)

Beschreibung

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.

Schwachstellentyp (CWE): CWE-94

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
amq streams 2.9 —
amq streams 3.2 —
ansible automation platform 2.5 —
ansible automation platform 2.6 —
cluster observability operator 1.5 —
cryostat 4 —
discovery 2 —
edge manager 1.0 —
edge manager 1.1 —
enterprise linux 9 —
lodash lodash 4.0.0 – < 4.18.1, fixed 4.18.1
lodash lodash-amd 4.0.0 – < 4.18.1, fixed 4.18.1
lodash lodash-es 4.0.0 – < 4.18.1, fixed 4.18.1
lodash lodash.template 4.0.0 – < 4.18.1, fixed 4.18.1
migration toolkit virtualization 2.10 —
migration toolkit virtualization 2.9 —
network observ optr 1.11 —
openshift 4.12 —
openshift 4.13 —
openshift 4.14 —
openshift 4.15 —
openshift 4.16 —
openshift 4.17 —
openshift 4.18 —
openshift 4.19 —
openshift 4.20 —
openshift 4.21 —
openshift 4.22 —
openshift ai 2.25 —
openshift ai 3.3 —
openshift data foundation 4.16 —
openshift data foundation 4.17 —
openshift data foundation 4.18 —
openshift data foundation 4.19 —
openshift data foundation 4.20 —
openshift devspaces 3.27 —
openshift distributed tracing 3.9 —
openshift gitops 1.18 —
openshift gitops 1.19 —
Red Hat Cluster Observability Operator 1.5.0 all versions
Red Hat Cryostat 4 on RHEL 9 all versions
Red Hat Migration Toolkit for Virtualization 2.1 all versions
Red Hat Migration Toolkit for Virtualization 2.9 all versions
Red Hat Network Observability (NETOBSERV) 1.11.0 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 all versions
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 all versions
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 all versions
Red Hat Red Hat Data Grid 8.6.1 —
Red Hat Red Hat Developer Hub 1.8 all versions
Red Hat Red Hat Developer Hub 1.9 all versions
Red Hat Red Hat Edge Manager 1.0 all versions
Red Hat Red Hat Edge Manager 1.1 all versions
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On all versions
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support all versions
Red Hat Red Hat Migration Toolkit 1.8 all versions
Red Hat Red Hat OpenShift AI 2.25 all versions
Red Hat Red Hat OpenShift AI 3.3 all versions
Red Hat Red Hat OpenShift Container Platform 4.12 all versions
Red Hat Red Hat OpenShift Container Platform 4.13 all versions
Red Hat Red Hat OpenShift Container Platform 4.14 all versions
Red Hat Red Hat OpenShift Container Platform 4.15 all versions
Red Hat Red Hat OpenShift Container Platform 4.16 all versions
Red Hat Red Hat OpenShift Container Platform 4.17 all versions
Red Hat Red Hat OpenShift Container Platform 4.18 all versions
Red Hat Red Hat OpenShift Container Platform 4.19 all versions
Red Hat Red Hat OpenShift Container Platform 4.20 all versions
Red Hat Red Hat OpenShift Container Platform 4.21 all versions
Red Hat Red Hat OpenShift Container Platform 4.22 all versions
Red Hat Red Hat Openshift Data Foundation 4.16 all versions
Red Hat Streams for Apache Kafka 2.9.4 —
Red Hat Streams for Apache Kafka 3.2.0 —
rhdh 1.8 —
rhdh 1.9 —
rhel aus 8.4 —
rhel e4s 8.6 —
rhel e4s 8.8 —
rhel e4s 9.0 —
rhel e4s 9.2 —
rhel eus 9.4 —
rhel eus 9.6 —
rhel eus long life 8.4 —
rhel tus 8.6 —
rhel tus 8.8 —
rhmt 1.8 —
satellite 6.18 —
service mesh 2.6 —
service mesh 3.0 —
service mesh 3.1 —
service mesh 3.2 —
service mesh 3.3 —
trusted artifact signer 1.3 —

Referenzen und Patches

CPE-Treffer (NVD) (4)
  • cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* ≥ 4.0.0 < 4.18.0
  • cpe:2.3:a:lodash:lodash-amd:*:*:*:*:*:node.js:*:* ≥ 4.0.0 < 4.18.0
  • cpe:2.3:a:lodash:lodash-es:*:*:*:*:*:node.js:*:* ≥ 4.0.0 < 4.18.0
  • cpe:2.3:a:lodash:lodash.template:*:*:*:*:*:node.js:*:* ≥ 4.0.0 < 4.18.0

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

4.4Mittel
CVE-2026-123876

Podman: containers-common: containers-common: default seccomp af_vsock/netlink_audit deny rules bypassable via 32-bit truncation

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Hardened Images

A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper…

6.2Mittel
CVE-2026-120749

Dbus: dbus-daemon: dbus-daemon aborts (reply_serial != 0) when a broadcast from the driver cannot be delivered to a monitored bus

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesCha…

6.7Mittel
CVE-2026-123037

Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)

Red Hat Migration Toolkit for Applications 8; Red Hat Migration Toolkit for Virtualization; Red Hat OpenShift Service Mesh 3; Red Hat Red Hat Advanced Cluster Management for Kubernetes 2

A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their …

7.5Hoch
CVE-2026-123151

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitr…

8.1Hoch
CVE-2026-121997

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actua…

8.2Hoch
CVE-2026-121996

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeat…