Security

Lodash treats all input — arrays, objects, strings, and functions — as untrusted data. It does not validate or sanitize the semantic correctness of values you pass in; it operates on values as given. This guide covers the two places that distinction matters most: _.template and deep-write methods such as set and merge.

_.template executes code — avoid untrusted input

_.template compiles a template string into a JavaScript function. The current implementation can lead to code injection when given untrusted input, as described in CVE-2021-23337. The Lodash maintainers consider it insecure and plan to remove it in v5.

// Safe: both the template string and the data are static and developer-controlled.
var compiled = _.template('hello <%= user %>!');
compiled({ user: 'fred' });
// => 'hello fred!'

If you render untrusted content, use a templating engine designed for that purpose and HTML-escape output at the point of use, rather than relying on _.template's escape delimiter as a security boundary.

Deep-write methods filter __proto__, but reads are normal JavaScript

The set, merge, and similar deep-write methods block writes to __proto__ and constructor.prototype, so passing an attacker-controlled path or object through them does not let an attacker pollute Object.prototype:

var target = {};
_.set(target, '__proto__.polluted', true);

target.polluted;
// => undefined
({}).polluted;
// => undefined (Object.prototype was not modified)

This protection covers writes. It does not — and cannot — prevent normal JavaScript property lookup from reaching inherited properties through the prototype chain (obj.constructor, or walking obj.__proto__). Reading an inherited property is a language feature, not a Lodash vulnerability.

Report a vulnerability

Lodash requests responsible disclosure through the Security tab of its GitHub repository rather than a public issue. See SECURITY.md for the current escalation path if you don't receive an acknowledgement.

Related reference

• _.template — full parameter and option reference.
• _.set, merge, mergeWith — deep-write methods covered by the prototype-pollution protection.