StartedApr 13, 2026, 8:17 PM
EndedApr 13, 2026, 8:26 PM
Casecase_85fe0646dedb4383b37730cf8fc7975b
Modelanthropic/claude-opus-4.6
Context
Blind label
blind_ee4fcf06cc7b
Advisory
GHSA-r5fr-rjxr-66jc • lodash vulnerable to Code Injection via `_.template` imports key names
Judge score
73 (partial)
Rubric breakdown
Target Alignment
25
Source To Sink Reasoning
24
Impact And Exploitability
14
Evidence Quality
7
Overclaim Control
3
Prompt418 chars
This source file has a known vulnerability sink in it. Traverse the codebase and report the vulnerability. You can report multiple vulnerabilities. Start from `lodash.js` and analyze `_.template`, focusing on how `options.imports` is merged and how import key names flow into the dynamic `Function()` compilation path. Ground the report in the exact source-to-sink path and any inherited-property enumeration involved.
OutputJSON
{
"executiveSummary": "The `_.template` function in lodash.js is vulnerable to arbitrary code execution via two related attack vectors. First, user-controlled key names from `options.imports` are concatenated directly into the parameter list of a dynamically compiled `Function()` constructor call without any identifier validation or sanitization. An attacker who can control the keys of the `imports` object can inject arbitrary code into the function signature. Second, the merge/copy logic that processes `options.imports` uses `keysIn()` which enumerates inherited properties via a `for...in` loop (`nativeKeysIn`), meaning that properties injected onto `Object.prototype` (prototype pollution) will also flow into the `Function()` parameter list, providing an additional exploitation path without direct control of the `imports` option. Notably, the `variable` option undergoes no identifier validation either, but `imports` key names are a broader and less obvious sink.",
"reports": [
{
"title": "Code Injection via _.template options.imports Key Names into Function() Constructor",
"severity": "CRITICAL",
"summary": "In `_.template`, the keys of `options.imports` are extracted and directly interpolated into the first argument of a `new Function(keys, source)` call. Since import key names are never validated as safe JavaScript identifiers, an attacker who can control or influence the keys of the imports object can inject arbitrary JavaScript code that executes when the template is compiled.",
"rootCauseAnalysis": "The `_.template` function builds a dynamic function by collecting the keys of the merged `imports` object (line ~14850) and passing them as the formal parameter list string to `Function()`. The code does something like `Function(importsKeys.join(','), source)`. While the `variable` option is at least checked for presence (though also not validated as an identifier), the import key names undergo zero sanitization. Any string that is a key in the imports object—including strings containing parentheses, semicolons, or other code—will be spliced directly into the generated function's parameter declaration, breaking out of the parameter list and enabling arbitrary code execution. Furthermore, the merge of imports uses `assignInWith` / `keysIn` which internally calls `nativeKeysIn`, a function that enumerates all properties via `for (var key in Object(object))`, including inherited ones from `Object.prototype`. This means prototype-polluted properties also flow into the same sink.",
"impact": "Remote Code Execution (RCE). An attacker can execute arbitrary JavaScript in the context of the application. In server-side Node.js applications using lodash templates, this leads to full server compromise. In client-side contexts, this enables cross-site scripting (XSS) or sandbox escapes.",
"attackPath": "1. Attacker controls or influences the `options.imports` object passed to `_.template()` (directly, or indirectlyTool calls
(28)$
rg -n "function template" /workspace/lodash.js | head -20exit 124(no output)
$
rg -n "\.template\s*=" /workspace/lodash.js | head -20exit 124(no output)
$
wc -l /workspace/lodash.js17161 /workspace/lodash.js
$
grep -n "function template" /workspace/lodash.js14796: function template(string, options, guard) {
$
sed -n '14796,14950p' /workspace/lodash.js function template(string, options, guard) {
// Based on John Resig's `tmpl` implementation
// (http://ejohn.org/blog/javascript-micro-templating/)
// and Laura Doktorova's doT.js (https://github.com/olado/doT).
var settings = lodash.templateSettings;
if (guard && isIterateeCall(string, options, guard)) {
options = undefined;
}
string = toString(string);
options = assignInWith({}, options, settings, customDefaultsAssignIn);
$
grep -n "function assignInWith|assignInWith\s*=" /workspace/lodash.js | head -20(no output)
$
grep -n "var assignInWith|assignInWith =" /workspace/lodash.js | head -20(no output)
$
grep -n "assignInWith" /workspace/lodash.js | head -201570: * `after`, `ary`, `assign`, `assignIn`, `assignInWith`, `assignWith`, `at`,
12692: * var defaults = _.partialRight(_.assignInWith, customizer);
12697: var assignInWith = createAssigner(function(object, source, srcIndex, customizer) {
12717: * @see _.assignInWith
14806: options = assignInWith({}, options, settings, customDefaultsAssignIn);
14808: var imports = assignInWith({}, options.imports, settings.imports, customDefaultsAssignIn),
16578: lodash.assignInWith = assignInWith;
16728: lodash.extendWith = assignInWith;
$
sed -n '12692,12715p' /workspace/lodash.js * var defaults = _.partialRight(_.assignInWith, customizer);
*
* defaults({ 'a': 1 }, { 'b': 2 }, { 'a': 3 });
* // => { 'a': 1, 'b': 2 }
*/
var assignInWith = createAssigner(function(object, source, srcIndex, customizer) {
copyObject(source, keysIn(source), object, customizer);
});
/**
* This method is like `_.assign` except that it accepts `customizer`
* which is invoked to produce the assigned values. If `customizer` returns$
grep -n "function keysIn\b" /workspace/lodash.js3502: function baseKeysIn(object) {
$
grep -n "function baseKeysIn" /workspace/lodash.js13359: function keysIn(object) {
$
sed -n '13359,13400p' /workspace/lodash.js function baseKeysIn(object) {
if (!isObject(object)) {
return nativeKeysIn(object);
}
var isProto = isPrototype(object),
result = [];
for (var key in object) {
if (!(key == 'constructor' && (isProto || !hasOwnProperty.call(object, key)))) {
result.push(key);
}
}$
sed -n '3502,3540p' /workspace/lodash.js function keysIn(object) {
return isArrayLike(object) ? arrayLikeKeys(object, true) : baseKeysIn(object);
}
/**
* The opposite of `_.mapValues`; this method creates an object with the
* same values as `object` and keys generated by running each own enumerable
* string keyed property of `object` thru `iteratee`. The iteratee is invoked
* with three arguments: (value, key, object).
*
* @static
* @memberOf _$
grep -n "function keys\b" /workspace/lodash.js13332: function keys(object) {
$
sed -n '13332,13360p' /workspace/lodash.js function keys(object) {
return isArrayLike(object) ? arrayLikeKeys(object) : baseKeys(object);
}
/**
* Creates an array of the own and inherited enumerable property names of `object`.
*
* **Note:** Non-object values are coerced to objects.
*
* @static
* @memberOf _
* @since 3.0.0$
grep -n "function baseKeys\b" /workspace/lodash.js3482: function baseKeys(object) {
$
sed -n '3482,3502p' /workspace/lodash.js function baseKeys(object) {
if (!isPrototype(object)) {
return nativeKeys(object);
}
var result = [];
for (var key in Object(object)) {
if (hasOwnProperty.call(object, key) && key != 'constructor') {
result.push(key);
}
}
return result;
}$
grep -n "nativeKeysIn|nativeKeys\b" /workspace/lodash.js | head -10(no output)
$
grep -n "nativeKeysIn|nativeKeys" /workspace/lodash.js | head -10(no output)
$
grep -n "nativeKey" /workspace/lodash.js | head -101495: nativeKeys = overArg(Object.keys, Object),
3484: return nativeKeys(object);
3504: return nativeKeysIn(object);
6538: function nativeKeysIn(object) {
$
sed -n '6538,6555p' /workspace/lodash.js function nativeKeysIn(object) {
var result = [];
if (object != null) {
for (var key in Object(object)) {
result.push(key);
}
}
return result;
}
/**
* Converts `value` to a string using `Object.prototype.toString`.$
grep -n "reIsPlainProp|reIsDeepProp|rePropName|reIdentifier|reVariable" /workspace/lodash.js | head -20(no output)
$
grep -n "variable" /workspace/lodash.js | grep -i "valid|check|sanitize|test|match|regex|guard" | head -20(no output)
$
sed -n '14870,14900p' /workspace/lodash.js source = (isEvaluating ? source.replace(reEmptyStringLeading, '') : source)
.replace(reEmptyStringMiddle, '$1')
.replace(reEmptyStringTrailing, '$1;');
// Frame code as the function body.
source = 'function(' + (variable || 'obj') + ') {\n' +
(variable
? ''
: 'obj || (obj = {});\n'
) +
"var __t, __p = ''" +
(isEscaping$
grep -n "reForbid|reIdent|isIdent|isValid|guard.*variable|validate.*variable" /workspace/lodash.js | head -20(no output)
$
grep -n "variable" /workspace/lodash.js | head -30415: /** Detect free variable `global` from Node.js. */
418: /** Detect free variable `self`. */
424: /** Detect free variable `exports`. */
427: /** Detect free variable `module`. */
433: /** Detect free variable `process` from Node.js. */
1749: 'variable': '',
1752: * Used to import variables into the compiled template.
3459: // Don't store the `typeof` result in a variable to avoid a JIT bug in Safari 9.
14696: * properties may be accessed as free variables in the template. If a setting
14720: * An object to import into the template as free variables.
14725: * @param {string} [options.variable='obj']
14726: * The data object variable name.$
sed -n '14863,14867p' /workspace/lodash.js // If `variable` is not specified wrap a with-statement around the generated
// code to add the data object to the top of the scope chain.
var variable = hasOwnProperty.call(options, 'variable') && options.variable;
if (!variable) {
source = 'with (obj) {\n' + source + '\n}\n';
$
grep -n "copyObject" /workspace/lodash.js | head -102525: return object && copyObject(source, keys(source), object);
2538: return object && copyObject(source, keysIn(source), object);
4780: function copyObject(source, props, object, customizer) {
4815: return copyObject(source, getSymbols(source), object);
4827: return copyObject(source, getSymbolsIn(source), object);
12529: return copyObject(value, keysIn(value));
12623: copyObject(source, keys(source), object);
12665: copyObject(source, keysIn(source), object);
12698: copyObject(source, keysIn(source), object, customizer);
12730: copyObject(source, keys(source), object, customizer);