HIGH CVSS Exploitable CVE in Code Repository #15

🔐 Security Remediation Task: HIGH CVSS Exploitable CVE in Code Repository — lodash/lodash-es + CVE-2026-4800 (×2 packages)

For AI Agent: This issue is auto-generated from Wiz. All information needed to remediate is below. Do not ask for clarification. Weigh the exploitation signals (EPSS / public exploit / PoC) and actual code reachability before acting — not every listed finding must become a code change: deferring a genuinely unreachable, low-signal, non-critical finding (with a recorded reason) is a valid disposition. Never claim to fix a CVE the resource is not actually exposed to.

📍 Resource Context

🤖 Green Agent Analysis

No Green Agent analysis available for this issue.

📋 Findings (Medium+ · Sorted by Exploitation Likelihood)

Finding 1: CVE-2022-46175 — HIGH (json5 v1.0.1, ×2 paths)

Description:
The JSON5.parse() method in json5 versions ≤ 1.0.1 and ≤ 2.2.1 does not restrict parsing of keys named __proto__, enabling prototype pollution on the returned object. An attacker who can supply a crafted JSON5 string to a code path using JSON5.parse() can set arbitrary inherited properties on the parsed object. Depending on how the application uses that object, this may lead to denial of service, XSS, privilege escalation, or in extreme cases remote code execution. The EPSS score of 9.2% and confirmed public exploit/PoC make this a credible risk where the parse method is reachable with untrusted input.

AI Analysis Summary:
No reachability analysis available — the agent must assess reachability itself; weigh the exploitation signals above (EPSS 9.2%, public exploit confirmed) and do NOT assume exploitable without tracing call sites.

Bump json5 to ≥ 1.0.2 (for 1.x consumers) and ≥ 2.2.2 (for 2.x consumers) in /yarn.lock and regenerate the lockfile with yarn upgrade json5; if transitive with no clean root bump, weigh override vs. defer per the exploitation signals.

Finding 2: CVE-2024-4068 — HIGH (braces v3.0.2, ×2 paths)

Description:
The braces NPM package versions prior to 3.0.3 fail to limit the number of characters processed by the parser. If a malicious user supplies "imbalanced braces" as input, lib/parse.js enters an infinite loop that continuously allocates heap memory without releasing it, eventually exhausting the JavaScript heap limit and crashing the Node.js process. This is a denial-of-service vulnerability. A public exploit exists (VulnCheck / upstream PR). Trigger requires the attacker to control input passed through a braces-consuming code path (commonly via glob/minimatch patterns).

AI Analysis Summary:
No reachability analysis available — the agent must assess reachability itself; weigh the exploitation signals above (public exploit confirmed, EPSS 1.5%) and do NOT assume exploitable without tracing call sites.

Bump braces to ≥ 3.0.3 in /yarn.lock using yarn upgrade braces; if transitive with no clean root bump, weigh override vs. defer per the exploitation signals.

Finding 3: CVE-2026-4800 — CRITICAL (lodash v4.17.21)

Description:
The fix for CVE-2021-23337 added validation for _.template's variable option but failed to apply the same validation to options.imports key names. Both paths feed into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary JavaScript at template compilation time. Additionally, _.template uses assignInWith (enumerates inherited properties via for..in), meaning a prior prototype pollution can cause polluted keys to flow into Function(). Wiz Threat Research has flagged that initial access potential is overridden to FALSE because exploitation requires specific application conditions (untrusted input reaching options.imports). The CVSS score of 9.8 is high, but actual risk depends heavily on code reachability.

AI Analysis Summary:
Wiz Threat Research has overridden initial access potential to FALSE for CVE-2026-4800 since the vulnerability is only exploitable under specific conditions (untrusted input passed as options.imports key names to _.template). The agent must assess whether the application passes user-controlled data to this code path before treating this as critical priority. A public PoC exists (VulnCheck).

Bump lodash to ≥ 4.18.0 in /yarn.lock using yarn upgrade lodash; if transitive with no clean root bump, weigh override vs. defer per the exploitation signals and reachability assessment.

Finding 4: CVE-2026-4800 — CRITICAL (lodash-es v4.17.21)

Description:
Same vulnerability class as Finding 3 (CVE-2026-4800) but affecting the ESM variant lodash-es. The _.template function's options.imports key names are passed unsanitized into a Function() constructor, enabling code injection when untrusted input reaches that path. Additionally assignInWith enumerates inherited properties, creating a prototype-pollution amplification path. Wiz Threat Research has overridden initial access potential to FALSE. The CVSS of 9.8 is critical on paper; actual exploitability depends on whether application code routes untrusted data into _.template imports.

AI Analysis Summary:
Wiz Threat Research has overridden initial access potential to FALSE for CVE-2026-4800 on lodash-es since the vulnerability is only exploitable under specific conditions. Same guidance as Finding 3. Agent must trace lodash-es usage with yarn why lodash-es and verify call sites before prioritising.

Bump lodash-es to ≥ 4.18.0 in /yarn.lock using yarn upgrade lodash-es; if transitive with no clean root bump, weigh override vs. defer per the exploitation signals and reachability assessment.

Finding 5: CVE-2022-25883 — HIGH (semver, ×5 paths)

Description:
Multiple versions of the semver package across the 5.x, 6.x, and 7.x branches are vulnerable to Regular Expression Denial of Service (ReDoS) via the new Range() function when untrusted user data is provided as a range string. A maliciously crafted version range string can cause catastrophic backtracking in the regex engine, blocking the event loop and denying service. No public exploit or PoC exists. Risk is primarily DoS when untrusted version range strings reach semver.Range() — common in package management tooling or CI scripts but less likely in production service code.

AI Analysis Summary:
No reachability analysis available — the agent must assess reachability itself; weigh the exploitation signals above (EPSS 2.8%, no public exploit) and do NOT assume exploitable without tracing call sites.

Bump semver to ≥ 5.7.2 (5.x consumers), ≥ 6.3.1 (6.x consumers), ≥ 7.5.2 (7.x consumers) in /yarn.lock using yarn upgrade semver; if transitive with no clean root bump, weigh override vs. defer per the exploitation signals.

🧭 Remediation Priority Order

1. CVE-2022-46175 (json5) — EPSS 9.2% (highest in this set) + confirmed public exploit + public PoC; prototype pollution with potential for privilege escalation or RCE where JSON5.parse receives untrusted input.
2. CVE-2024-4068 (braces) — confirmed public exploit + public PoC; DoS via heap exhaustion when braces parser receives attacker-controlled input.
3. CVE-2026-4800 (lodash) — CVSS 9.8, public exploit + PoC; RCE via _.template imports injection — but Wiz Threat Research overrides initial access to FALSE (specific conditions required); assess _.template usage before treating as critical.
4. CVE-2026-4800 (lodash-es) — same as lodash above; ESM variant; identical risk profile and Wiz override; assess call sites.
5. CVE-2022-25883 (semver) — EPSS 2.8%, no public exploit or PoC; ReDoS only; likely defer if semver is only used in build/CI tooling not processing untrusted input.

✅ Definition of Done

Close this issue only when ALL of the following are true:

• Each finding above has been either remediated OR given an explicit, recorded disposition (fixed / deferred-with-reason / false-positive) — deferring a low-signal, unreachable, non-critical finding is a valid disposition
• For each remediated finding, yarn list <package> confirms the upgraded version is in use and no older vulnerable version remains
• No new medium+ severity findings introduced by the fix (run yarn audit after upgrade)
• The change is traceable (PR link, change ID, or deployment reference)

🏷️ Metadata

• Auto-generated by: Wiz Security Platform
• Generated at: 2026-10-08 20:56:53 UTC
• Wiz Issue ID: 5f20cf64-222b-4dd8-a6f4-0abe6700a3c0
• Wiz Issue Type: VULNERABILITY
• Affected Branch: stroeer/github-app-token/main
• Do not close manually — remediation must be validated (or an explicit disposition recorded) before closing.

View Wiz Issue
Wiz Issue ID: 5f20cf64-222b-4dd8-a6f4-0abe6700a3c0
Source Workflow: Wiz Issues → GitHub (Green Agent)