The vulnerability arises from the template rendering function in Lodash allowing unvalidated names of keys supplied in the options.imports object. These key names are used to create default-parameter expressions that are compiled with the JavaScript Function constructor. Because no validation is performed on the key names after the core patch for a prior issue, an attacker can supply crafted key names that are interpreted as code and executed at compile time, resulting in arbitrary code execution in the JavaScript runtime. This flaw is a classic code‑injection weakness (CWE‑94) that controls program execution flow.

The flaw affects multiple Lodash distributions, including the core library (lodash), the AMD build, the ES module build, and the standalone template module. All versions of these packages released before the 4.18.0 patch are considered vulnerable. Users of these packages in Node.js or browser environments that construct templates from potentially untrusted data are at risk.

The CVSS score of 8.1 indicates a high severity. The EPSS score is reported below 1%, suggesting that the risk of exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an environment where the application supplies key names for template imports from untrusted sources or where the JavaScript prototype chain has been polluted; either condition allows an attacker to inject malicious code that runs when the template is compiled. The attack would grant full control over the runtime in server‑side or client‑side contexts where the vulnerable code executes.