Lodash Patches High-Severity Code Injection Vulnerability

An advisory for CVE-2026-4800: a high-severity (CVSS 8.1) code-injection vulnerability in Lodash's _.template function caused by lack of validation for options.imports key names. Untrusted keys can inject default-parameter expressions that execute via the Function() constructor, and the issue is worsened by assignInWith merging which copies inherited (potentially polluted) properties — upgrade to Lodash 4.18.0 immediately or ensure only developer-controlled import key names are used.