From e20891de6fe0d3aa70849781a85f188e9498c0cc Mon Sep 17 00:00:00 2001
From: German Parente <gparente@redhat.com>
Date: Mon, 8 Jun 2026 18:44:24 +0200
Subject: [PATCH] Fix for OCPBUGS-81600: CVE-2026-4800 Arbitrary code execution
 via untrusted input in template imports

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 frontend/package.json                                |  4 ++--
 frontend/packages/console-plugin-shared/package.json |  2 +-
 frontend/yarn.lock                                   | 12 ++++++------
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/frontend/package.json b/frontend/package.json
index 0108b99f655..968a900abb6 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -192,7 +192,7 @@
     "js-base64": "^2.5.1",
     "js-yaml": "^3.13.1",
     "json-schema": "^0.3.0",
-    "lodash-es": "^4.17.23",
+    "lodash-es": "^4.18.1",
     "monaco-languageclient": "^0.13.0",
     "murmurhash-js": "1.0.x",
     "openshift-logos-icon": "1.7.1",
@@ -357,7 +357,7 @@
     "dompurify": "3.2.7",
     "hosted-git-info": "^3.0.8",
     "jquery": "3.5.1",
-    "lodash-es": "^4.17.23",
+    "lodash-es": "^4.18.1",
     "minimist": "1.2.5",
     "ua-parser-js": "^0.7.24",
     "jest": "21.x",
diff --git a/frontend/packages/console-plugin-shared/package.json b/frontend/packages/console-plugin-shared/package.json
index 409d3713679..053733f8dcd 100644
--- a/frontend/packages/console-plugin-shared/package.json
+++ b/frontend/packages/console-plugin-shared/package.json
@@ -20,7 +20,7 @@
   },
   "dependencies": {
     "classnames": "2.x",
-    "lodash-es": "^4.17.21",
+    "lodash-es": "^4.18.1",
     "sanitize-html": "^2.3.2",
     "showdown": "1.8.6"
   },
diff --git a/frontend/yarn.lock b/frontend/yarn.lock
index 9b658aff62d..c7b6951b9ff 100644
--- a/frontend/yarn.lock
+++ b/frontend/yarn.lock
@@ -2817,7 +2817,7 @@ __metadata:
   dependencies:
     "@types/showdown": "npm:1.9.4"
     classnames: "npm:2.x"
-    lodash-es: "npm:^4.17.21"
+    lodash-es: "npm:^4.18.1"
     sanitize-html: "npm:^2.3.2"
     showdown: "npm:1.8.6"
   peerDependencies:
@@ -16607,10 +16607,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"lodash-es@npm:^4.17.23":
-  version: 4.17.23
-  resolution: "lodash-es@npm:4.17.23"
-  checksum: 10c0/3150fb6660c14c7a6b5f23bd11597d884b140c0e862a17fdb415aaa5ef7741523182904a6b7929f04e5f60a11edb5a79499eb448734381c99ffb3c4734beeddd
+"lodash-es@npm:^4.18.1":
+  version: 4.18.1
+  resolution: "lodash-es@npm:4.18.1"
+  checksum: 10c0/35d4dcf87ef07f8d090f409447575800108057e360b445f590d0d25d09e3d1e33a163d2fc100d4d072b0f901d5e2fc533cd7c4bfd8eeb38a06abec693823c8b8
   languageName: node
   linkType: hard
 
@@ -18651,7 +18651,7 @@ __metadata:
     js-yaml: "npm:^3.13.1"
     json-schema: "npm:^0.3.0"
     lint-staged: "npm:^10.2.2"
-    lodash-es: "npm:^4.17.23"
+    lodash-es: "npm:^4.18.1"
     mini-css-extract-plugin: "npm:^1.6.2"
     minimist: "npm:1.2.5"
     mocha-junit-reporter: "npm:^1.23.3"