Validate imports keys in _.template
fix: validate imports keys in _.template
Validate imports keys in _.template879aaa-fix-validate-imports-keys-in-template-cve-2026-4800fixvalidate imports keys template
Committed by UlisesGascon
commit message
fix: validate imports keys in _.template
Fixes an incomplete patch for CVE-2021-23337. The `variable` option was validated against `reForbiddenIdentifierChars` but `importsKeys` was left unguarded, allowing code injection via the same `Function()` constructor sink.
This patch:
1. Validates `importsKeys` against `reForbiddenIdentifierChars`
2. Replaces `assignInWith` with `assignWith` when merging imports
Ref: https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
Ref: CVE-2026-4800
---------
Co-authored-by: Jon Church <[email protected]>Editor assessment
This commit patches CVE-2026-4800. The subject is compact and the body immediately supplies the crucial context: this closes an incomplete patch for CVE-2021-23337, where the variable option was validated but importsKeys was left unguarded and reached the same Function constructor sink. It then enumerates both parts of the remedy, validating importsKeys against the forbidden-character pattern and switching assignInWith to assignWith when merging imports. Two Ref footers and a co-author trailer round it out cleanly. The message explains the prior failure, the sink, and the correction without pasting any code, which is precisely what a future maintainer needs. This is a model security-fix message.