CVE-2026-4800

High

Advisory

Published 6 May 2021In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: 0.213; 97th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 472; of 17,787 indexed, latest versions
Container images: 491; deployed by those charts
Fix available: 4 of 4; affected packages

lodash vulnerable to Code Injection via `_.template` imports key names

Carried by container images the latest versions of 472 of 17,787 indexed charts deploy, on 491 images.

Affected package	Affected versions	Fixed in	Images
lodashnpm	0.9.2, 1.0.2, 1.3.1, 2.4.1+13 more	4.17.21, 4.18.0	484
lodash-esnpm	4.17.4, 4.17.15, 4.17.20, 4.17.21+2 more	4.17.21, 4.18.0	112
lodash.templatenpm	2.4.1, 3.6.2, 4.5.0, 4.17.15+1 more	4.18.0	44
node-lodashdeb	4.17.15+dfsg-2, 4.17.21+dfsg+~cs8.31.198.20210220-9	4.17.15+dfsg-2ubuntu0.1~esm1, 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1	3

OSV records: GHSA-35jh-r3h4-6jhm GHSA-r5fr-rjxr-66jc UBUNTU-CVE-2026-4800
Also known as: CVE-2021-23337, USN-8411-1

Charts affected

472 by stars

Chart

Latest

Affected images

Radar Score

unleash-enterpriseunleash

1.0.3

1 of 1 See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
unleashorg/unleash-enterprise :7.5.0	245aeba40053	lodash@4.17.23	4.18.0

Open the chart page →

2,028

excalidashunxwares

2026.2.5

1 of 2 See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
zimengxiong/excalidash-backend :0.4.27	1273af713c91	lodash@4.17.23	4.18.0

Open the chart page →

2,620

kenerunxwares

2026.2.5

1 of 1 See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
rajnandan1/kener :3.2.19	30407afca731	lodash@4.17.21	4.18.0

Open the chart page →

5,228

evolution-apivcnngr

1.0.0

1 of 5 See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
evoapicloud/evolution-api :latest	966625532d90	lodash@4.17.21	4.18.0

Open the chart page →

3,746

genievhdirk

0.1.3

1 of 1 See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
stanfordoval/almond-server :latest	1a63cdccedaf	lodash@4.17.21	4.18.0

Open the chart page →

3,129

homarrvhdirk

0.1.5

1 of 1 See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
ghcr.io/ajnart/homarr :latest	e103abadfb52	lodash@4.17.21	4.18.0

Open the chart page →

2,789

skoonervhdirk

0.1.4

1 of 1 See more

skooner vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
ghcr.io/skooner-k8s/skooner :stable	60c1562e4d51	lodash@4.17.21	4.18.0

Open the chart page →

1,341

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	lodash-es@4.17.23	4.18.0

Open the chart page →

4,305

hedgedocvista

0.1.1

1 of 1 See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
quay.io/hedgedoc/hedgedoc :1.9.4	e09967519a1d	lodash@4.17.21	4.18.0

Open the chart page →

3,118

sirenwateim

1.0.2

1 of 1 See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
sigp/siren :v3.0.4	2c219b04758e	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0

Open the chart page →

5,984

wazuhwazuh-helm-eks

1.2.10

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0

Open the chart page →

5,484

queryservice-gatewaywbstack

0.2.0

1 of 1 See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/queryservice-gateway :2.2	ab8e2f583e56	lodash@4.17.20	4.17.21

Open the chart page →

2,559

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	lodash@4.17.21	4.18.0

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	lodash@4.17.21	4.18.0

Open the chart page →

28,605

cadencewenerme

0.23.0

1 of 5 See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
ubercadence/web :v3.29.5	8564a5b44a6d	lodash@4.17.20 lodash-es@4.17.20	4.17.21 4.17.21

Open the chart page →

10,127

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
temporalio/web :1.14.0	33cfa863d8ce	lodash@4.17.21 lodash-es@4.17.15	4.18.0 4.17.21

Open the chart page →

22,665

wikiwikijs

3.0.0

1 of 2 See more

5,459

kibanawiremind

8.5.23

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	lodash@4.17.21	4.18.0

Open the chart page →

6,285

opendistro-eswitcom-gmbh

1.13.3

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch-kibana :1.13.2	c740d7a89475	lodash@4.17.20 lodash-es@4.17.15	4.17.21 4.17.21

Open the chart page →

5,806

workadventureworkadventure

1.1.0

4 of 9 See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	lodash@4.17.21	4.18.0
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	lodash@4.17.21	4.18.0
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	lodash@4.17.21	4.18.0
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	lodash@4.17.21	4.18.0

Open the chart page →

16,083

skoonerxd

1.1.0

1 of 1 See more

1,752

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-4800.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0

Open the chart page →

9,381

Container images carrying it

491 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
sharanalwar/redchef-frontend :latest	5e82950b16b7	lodash@4.17.21	4.18.0	1
shinobisystems/shinobi :dev	3ca746937856	lodash@4.17.21	4.18.0	1
shinobisystems/shinobi :latest	c2f5ce2e1067	lodash@4.17.21	4.18.0	1
sigp/siren :v3.0.4	2c219b04758e	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
siscc/dotstatsuite-data-lifecycle-manager :v14.0.0	b6f9a7c888fc	lodash@4.17.21 lodash.template@4.5.0 lodash.template@4.5.0	4.18.0 4.18.0 no fix listed	1
skylenet/ethstats-server :pow-latest	d757cc016198	lodash@4.17.21	4.18.0	1
slagattollas/server-practica :latest	6dd8ead8e2b1	lodash@4.17.21	4.18.0	1
socialmediamacroscope/smile_graphql :0.3.1	c5095e94bc65	lodash@4.17.21 lodash@3.10.1	4.18.0 4.17.21	1
socialmediamacroscope/smile_server :0.3.3	1a528c794270	lodash@4.17.21	4.18.0	1
solidproject/community-server :6.0.2	ccc4acb7e9a1	lodash@4.17.21	4.18.0	1
someblackmagic/alertmanager-to-alerta-bot :latest	78bf43744ea5	lodash@4.17.21 lodash@4.17.15	4.18.0 4.17.21	1
someblackmagic/alert-mapper :v0.1.0	88351d85c04c	lodash@4.17.15 lodash@4.17.15	4.18.0 4.17.21	1
soulou2019/node-server :latest	5e6ecfcc109e	lodash@4.17.21	4.18.0	1
soulteary/cronicle :0.9.80	ac2512fa6e39	lodash@4.17.21	4.18.0	1
speckle/speckle-frontend-2 :2.20.2-branch.testing4.134160-9fad4b2	10ad4ade8bf2	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-frontend-2 :2.20.6-branch.testing1.154030-9b09114	32fc940d9b4c	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-frontend-2 :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	4f9241665ae3	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-frontend-2 :2.21.3-branch.testing5.219631-2153bef	d4ca6ebf09b9	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-frontend-2 :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	fdc008effc7a	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-monitor-deployment :2.25.10-branch.testing6.645-b125c1e	2dbc553ed87c	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-monitor-deployment :2.26.3	d51e1b0cf231	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-preview-service :2.26.3	092384dba45d	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-preview-service :2.20.2-branch.testing4.134160-9fad4b2	1f897ca906ea	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-preview-service :2.21.3-branch.testing5.219631-2153bef	52cad5e3293e	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-preview-service :2.23.14-branch.testing6.334655-b4e04ee	6dee853ba74a	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-preview-service :2.25.10-branch.testing6.645-b125c1e	787adcb20a3a	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-preview-service :2.17.14-branch.testing.72707.921a5f8	84fc39bca0c8	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-preview-service :2.20.6-branch.testing1.154030-9b09114	8f3c1ea153ba	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-preview-service :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	c102b087481a	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-preview-service :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	d3da0a84de98	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-server :2.17.14-branch.testing.72707.921a5f8	49d10dcdfb91	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-server :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	4b6a0750d5aa	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-server :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	52f8eabf5cea	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-server :2.20.2-branch.testing4.134160-9fad4b2	687f43ab16f3	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-server :2.25.10-branch.testing6.645-b125c1e	75cdf256067b	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-server :2.26.3	79f14a2bf931	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-server :2.18.12-branch.testing3.88744-f55b341	89a5872375f9	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-server :2.21.3-branch.testing5.219631-2153bef	8fd157733393	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-server :2.18.11-branch.testing2.88634-335d469	bf6a501b2210	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-server :2.20.6-branch.testing1.154030-9b09114	e8413f57b327	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-webhook-service :2.21.3-branch.testing5.219631-2153bef	06ecc7a66a40	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-webhook-service :2.20.3-branch.hotfix-2.20.2.149555-37ea0cb	107c63336ab5	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-webhook-service :2.19.2-branch.hotfix-2.19.1.124125-665e7e1	4828aee2277c	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-webhook-service :2.20.2-branch.testing4.134160-9fad4b2	70f5167d1d4d	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-webhook-service :2.18.12-branch.testing3.88744-f55b341	771f872cfa63	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-webhook-service :2.18.11-branch.testing2.88634-335d469	902b98ad5327	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-webhook-service :2.17.14-branch.testing.72707.921a5f8	99913052b72e	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-webhook-service :2.26.3	c58eb372c488	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-webhook-service :2.20.6-branch.testing1.154030-9b09114	cf1d99bad89a	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1
speckle/speckle-webhook-service :2.25.10-branch.testing6.645-b125c1e	dd9db6cbe9bb	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	1