CVE-2021-23337

Aliases:GHSA-35jh-r3h4-6jhmCVE-2026-4800GHSA-r5fr-rjxr-66jc
Advisory lineage Upstream: 0 Downstream: 5
Modified
Published: 31 Mar 2026, 19:25
Last modified:21 Jul 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
47/100
CVSS Score
8.1 HIGH
v3.1 (cve.org)
EPSS Score
22.41% HIGH
22% probability +21.67%
KEV
Not listed
Ransomware
No reports
Public exploits
6 found
Dark Web
Not detected

Timeline

31 Mar 2026, 19:25
Published
Vulnerability first disclosed
21 Jul 2026, 12:04
Last Modified
Vulnerability information updated

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVSS Metrics

  • v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  • v3.1•HIGH•Score: 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • v2.0•MEDIUM•Score: 6.5AV:N/AC:L/Au:S/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 22.41%• Percentile: 97%

Techniques & Countermeasures

  • CWE-94•Improper Control of Generation of Code ('Code Injection')

    The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected Systems

  • RubyGems•lodash-rails

    < 4.17.21

  • lodash•lodash

    < 4.17.21 | ≥ 4.0.0, < 4.18.0

  • lodash•lodash-amd

    ≥ 4.0.0, < 4.18.0

  • lodash•lodash-es

    ≥ 4.0.0, < 4.18.0

  • lodash•lodash.template

    ≥ 4.0.0, < 4.18.0

  • netapp•active_iq_unified_manager

    na

  • netapp•cloud_manager

    na

  • netapp•system_manager

    9.0

  • Npm•lodash

    < 4.17.21 | ≥ 4.0.0, < 4.18.0

  • Npm•lodash-amd

    ≥ 4.0.0, < 4.18.0

  • Npm•lodash-es

    < 4.17.21 | ≥ 4.0.0, < 4.18.0

  • Npm•lodash-template

    ≤ 1.0.0

  • Npm•lodash.template

    ≤ 4.5.0 | ≥ 4.0.0, < 4.18.0

  • oracle•banking_corporate_lending_process_management

    14.2.0 | 14.3.0 | 14.5.0

  • oracle•banking_credit_facilities_process_management

    14.2.0 | 14.3.0 | 14.5.0

  • oracle•banking_extensibility_workbench

    14.2.0 | 14.3.0 | 14.5.0

  • oracle•banking_supply_chain_finance

    14.2.0 | 14.3.0 | 14.5.0

  • oracle•banking_trade_finance_process_management

    14.2.0 | 14.3.0 | 14.5.0

  • oracle•communications_cloud_native_core_binding_support_function

    1.9.0

  • oracle•communications_cloud_native_core_policy

    1.11.0

  • oracle•communications_design_studio

    7.4.2.0.0

  • oracle•communications_services_gatekeeper

    7.0

  • oracle•communications_session_border_controller

    8.4 | 9.0

  • oracle•enterprise_communications_broker

    3.2.0 | 3.3.0

  • oracle•financial_services_crime_and_compliance_management_studio

    8.0.8.2.0 | 8.0.8.3.0

  • oracle•health_sciences_data_management_workbench

    2.5.2.1 | 3.0.0.0

  • oracle•jd_edwards_enterpriseone_tools

    < 9.2.6.1

  • Unknown•PeopleSoft Enterprise PeopleTools

    8.58 | 8.59

  • oracle•primavera_gateway

    ≥ 17.12.0, ≤ 17.12.11 | ≥ 18.8.0, ≤ 18.8.12 | ≥ 19.12.0, ≤ 19.12.11 | ≥ 20.12.0, ≤ 20.12.7

  • oracle•primavera_unifier

    ≥ 17.7, ≤ 17.12 | 18.8 | 19.12 | 20.12

  • oracle•retail_customer_management_and_segmentation_foundation

    19.0

  • siemens•sinec_ins

    < 1.0 | 1.0 | 1.0:sp1

References (92)