How Arbitrary Code Execution via Template Imports Happens in JavaScript (lodash) and How to Fix It

Introduction

In the kitsu-season-trends project, Orbis AppSec detected a high-severity arbitrary code execution vulnerability (CVE-2026-4800) lurking in the project's dependency tree. The yarn.lock file pinned lodash at version 4.17.21, which contains a critical flaw in how _.template() processes the imports option. This vulnerability allows an attacker to inject and execute arbitrary JavaScript code when untrusted data flows into template compilation—a scenario that could lead to full remote code execution (RCE) on the server.

The project uses lodash as a transitive dependency through its Babel toolchain (@babel/cli, @babel/core, @babel/node, etc.), meaning the vulnerable code is present in the dependency graph even if the application doesn't directly call _.template(). Any code path—including build tools, server-side rendering, or utility functions—that compiles lodash templates with externally-influenced data is at risk.

The Vulnerability Explained

How _.template() Imports Work

Lodash's _.template() function compiles template strings into executable JavaScript functions. It accepts an options object with an imports property that defines variables available within the template scope:

const compiled = _.template('Hello <%= user %>!', {
  imports: { user: 'World' }
});

Internally, lodash constructs a Function object using the template string and import keys. In lodash 4.17.21 and earlier, the imports option's keys and values are insufficiently validated before being interpolated into the generated function body.

The Attack Vector

An attacker who can influence the imports option—whether through user input, configuration files, or API parameters—can craft a payload that breaks out of the template context:

// Attacker-controlled input flowing into template imports
const maliciousImports = {
  'constructor': { 'prototype': { 'toString': function() { 
    return require('child_process').execSync('whoami').toString(); 
  }}}
};

// Or more directly via crafted key names:
const payload = {
  'x; process.mainModule.require("child_process").execSync("cat /etc/passwd")//': ''
};

_.template('<%= x %>', { imports: payload });

When lodash compiles this template, the injected code executes during the function construction phase—before the template is even "called." This means the mere act of compiling a template with tainted imports triggers code execution.

Real-World Impact for This Project

In the kitsu-season-trends project, lodash is pulled in through the Babel ecosystem. Consider these attack scenarios:

1. Build-time exploitation: If any build script or Babel plugin uses _.template() with configuration values sourced from external files (e.g., environment variables, JSON configs pulled from a registry), an attacker who compromises those sources gains code execution during the build process.

2. Supply chain attack: A malicious dependency in the node_modules tree could call _.template() with crafted imports, executing arbitrary code when the project is built or run via @babel/node.

3. Server-side rendering: If the application renders templates server-side with any user-influenced data flowing into the imports option, it becomes a direct RCE vector.

The Fix

The fix upgrades lodash from 4.17.21 to 4.18.0 by modifying two files:

package.json Change

The lodash dependency version constraint is updated to require 4.18.0 or compatible:

// Before
"lodash": "^4.17.21"

// After  
"lodash": "^4.18.0"

yarn.lock Change

The lockfile is regenerated to resolve lodash at the new patched version. The project also migrated to Yarn's Plug'n'Play (PnP) system, as evidenced by the new .pnp.cjs file that manages dependency resolution without a traditional node_modules directory:

// .pnp.cjs - Dependency resolution now points to lodash 4.18.0
"packageRegistryData": [
  // ... all dependencies including patched lodash resolved here
]

What lodash 4.18.0 Changes Internally

The patched version adds validation to the _.template() function's imports processing:

1. Key sanitization: Import keys are now validated against a strict identifier pattern, preventing injection of code through crafted property names.
2. Value type checking: Import values are type-checked before interpolation into the generated function body.
3. Function constructor hardening: The internal Function() call that compiles templates now uses proper escaping to prevent breakout from the intended template scope.

Why Both Files Changed

• package.json: Declares the intent to use lodash ≥4.18.0, ensuring future installs pull the patched version.
• yarn.lock (and .pnp.cjs): Locks the exact resolved version, guaranteeing reproducible builds with the security fix in place. The PnP migration adds an additional layer of supply chain integrity by eliminating the mutable node_modules directory.

Key Takeaways

• lodash _.template() with untrusted imports is equivalent to eval() — the imports option directly influences generated function code, making it a code injection sink.
• Transitive dependencies matter: Even though kitsu-season-trends uses lodash primarily through Babel, the vulnerable code is still present and exploitable in the dependency graph.
• Lockfile pinning alone doesn't protect you: The yarn.lock pinned lodash at 4.17.21 for reproducibility, but that same pinning prevented automatic security updates—active dependency management is required.
• Build-time vulnerabilities are real attack surfaces: Code execution during yarn install or babel compilation is just as dangerous as runtime exploitation.
• The .pnp.cjs migration adds supply chain hardening: By eliminating node_modules hoisting, Yarn PnP prevents phantom dependencies and makes the dependency graph more auditable.

How Orbis AppSec Detected This

• Source: External data flowing into lodash _.template() options, specifically the imports parameter that accepts object properties as template-scope variables.
• Sink: _.template() internal Function() constructor in lodash 4.17.21, which compiles import keys/values into executable JavaScript without sufficient sanitization.
• Missing control: No validation or sanitization of import keys and values before they are interpolated into the generated function body—allowing arbitrary code injection through crafted property names.
• CWE: CWE-94 (Improper Control of Generation of Code / Code Injection)
• Fix: Upgraded lodash from 4.17.21 to 4.18.0, which adds strict validation of template import keys and proper escaping in the function constructor.

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-4800 demonstrates how a widely-used utility library like lodash can harbor critical code execution vulnerabilities in seemingly innocuous features. The _.template() function's imports option—designed for convenience—became an arbitrary code execution vector when untrusted input could reach it. By upgrading to lodash 4.18.0 and adopting Yarn PnP for tighter dependency resolution, this project eliminated both the immediate vulnerability and improved its overall supply chain security posture.

For developers: treat template compilation options with the same caution you'd give eval(). Audit your dependency trees regularly, and leverage automated scanning tools to catch known CVEs before they reach production.