lodash’s _.template function accepts an options.imports object whose keys are directly fed into a Function constructor during compilation. If an attacker can supply untrusted key names (e.g., containing default‑parameter expressions) the constructor evaluates those expressions, allowing arbitrary JavaScript to run. Because _.template also copies inherited properties from Object.prototype via assignInWith, pollution of the prototype can additionally inject malicious keys that are automatically copied into imports. The result is a remote code execution vulnerability classified as CWE‑94.

All public lodash distributions—lodash, lodash‑amd, lodash‑es, and lodash‑template—are affected when the library version is older than 4.18.0. Applications that import the package through npm, yarn, or other package managers and use _.template with user‑supplied imports are at risk. The fix is to upgrade to 4.18.0 or later for all of these variants.

The vulnerability carries a high CVSS score of 8.1, indicating significant potential impact. Although an EPSS score is not available and the issue is not listed in the CISA KEV catalog, the rationale for exploitation remains strong: any code path that creates templates using untrusted imports can trigger the Function constructor. Attackers can craft malformed key names or employ an existing Object.prototype pollution vector to gain code execution on the host environment where the template is compiled, whether on a server or within client‑side JavaScript.