The Lodash library is susceptible to remote code execution due to improper input validation in the template compilation process, posing a severe risk to applications relying on this utility.

This is a code injection vulnerability (CWE-94) where the library fails to validate key names passed to the options.imports parameter, which are subsequently processed by a Function constructor. An unauthenticated attacker can exploit this by providing untrusted input to the template function to achieve remote code execution.

Successful exploitation allows an attacker to execute arbitrary code within the context of the application. This could lead to a full system compromise, unauthorized data exfiltration, or total service disruption. With a CVSS score of 8.1, this vulnerability represents a high-severity threat that requires immediate attention, especially for internet-facing applications that process user-supplied data through templates.

Immediate Action: Upgrade all instances of the lodash, lodash-es, lodash-amd, and lodash.template packages to version 4.18.0 or later immediately.

Proactive Monitoring: Review application logs for unusual template compilation patterns or unexpected input being passed to template utility functions.

Compensating Controls: Ensure that no untrusted, user-controlled input is ever passed as key names within the options.imports parameter of the _.template function.

Public Exploit Available: Unknown

Given the prevalence of Lodash in modern web applications, the risk posed by this vulnerability is significant. IT and security teams should prioritize identifying all dependencies using affected versions of Lodash and applying the 4.18.0 update across the development lifecycle to prevent potential remote code execution attacks.