GHSA-r5fr-rjxr-66jc: lodash.template fixed in 4.18.0

GHSA-r5fr-rjxr-66jc PUBLISHED CVSS 8.100000381469727 HIGH

lodash vulnerable to Code Injection via `_.template` imports key names

Record from GitHub Advisory Database · Published April 1, 2026

lodash.template is fixed in 4.18.0 (npm)

lodash vulnerable to Code Injection via `_.template` imports key names

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
lodash.template	npm	4.18.0
lodash-amd	npm	4.18.0
lodash	npm	4.18.0
lodash-es	npm	4.18.0
sqlpad	Chainguard	7.5.7-r17
vitess-23	Chainguard	23.0.3-r12
gitlab-rails-ce-19.1	Chainguard	19.1.7-r6
kubeflow-pipelines	Wolfi	2.16.0-r11
ts-patch	Wolfi	4.0.1-r3
opensearch-dashboards-3	Chainguard	3.5.0-r15
redisinsight	Chainguard	3.2.0-r5
opensearch-dashboards-2	Chainguard	2.19.5-r8

64 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1

8.100000381469727

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Versions
chainguard	sqlpad	0
chainguard	vitess-23	0
chainguard	gitlab-rails-ce-19.1	0
wolfi	kubeflow-pipelines	0
wolfi	ts-patch	0
chainguard	opensearch-dashboards-3	0
chainguard	redisinsight	0
chainguard	opensearch-dashboards-2	0
chainguard	arangodb-3.11	0
chainguard	tensorflow-cpu-jupyter	0
chainguard	tensorflow-gpu-jupyter	*
chainguard	kibana-9.3	0
npm	lodash.template	4.0.0
chainguard	opensearch-dashboards-2-fips	0
chainguard	foxx-cli	0
chainguard	langfuse-2	0
chainguard	kibana-9.0	0
npm	lodash-amd	4.0.0
wolfi	opensearch-dashboards-3	0
wolfi	prism	0

…and 58 more

Timeline

Apr 1, 2026 CVE Published
Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-r5fr-rjxr-66jc
vulnetix vdb fixes GHSA-r5fr-rjxr-66jc

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-r5fr-rjxr-66jc/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →