Skip to content

CVE-2021-23337

7.2 highEPSS 21%

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVSS 3.1: 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS: 21% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)
CWE: CWE-94
Published: 2021-02-15
Modified: 2026-10-08
Record from: the NVD, synced 2026-10-19

Affected

lodash:lodash
netapp:active_iq_unified_manager
netapp:cloud_manager
netapp:system_manager
oracle:banking_corporate_lending_process_management
oracle:banking_credit_facilities_process_management
oracle:banking_extensibility_workbench
oracle:banking_supply_chain_finance
oracle:banking_trade_finance_process_management
oracle:communications_cloud_native_core_binding_support_function
oracle:communications_cloud_native_core_policy
oracle:communications_design_studio
oracle:communications_services_gatekeeper
oracle:communications_session_border_controller
oracle:enterprise_communications_broker
oracle:financial_services_crime_and_compliance_management_studio
oracle:health_sciences_data_management_workbench
oracle:jd_edwards_enterpriseone_tools
oracle:peoplesoft_enterprise_peopletools
oracle:primavera_gateway
oracle:primavera_unifier
oracle:retail_customer_management_and_segmentation_foundation
siemens:sinec_ins

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-35jh-r3h4-6jhm	npm	lodash	<4.17.21	4.17.21
GHSA-35jh-r3h4-6jhm	npm	lodash-es	<4.17.21	4.17.21
GHSA-35jh-r3h4-6jhm	npm	lodash.template	<=4.5.0	no fix published
GHSA-35jh-r3h4-6jhm	npm	lodash-template	<=1.0.0	no fix published
GHSA-35jh-r3h4-6jhm	RubyGems	lodash-rails	<4.17.21	4.17.21

References

Check your stack JSON