Every CVE Search/ Get API key

CVE-2021-23337

Command Injection

7.2 HighPublic exploitFix available

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

21.3%Up 19.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.2

Command Injection

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Record
CVE-2021-23337
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
Updated
2026-11-02
EUVDEUVD-2021-0912 7.2

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Record
EUVD-2021-0912
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
Updated
2026-11-02
GitHub AdvisoriesGHSA-35jh-r3h4-6jhm 7.2

Command Injection in lodash

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Record
GHSA-35jh-r3h4-6jhm
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77, CWE-94
Updated
2026-11-02
NVD 7.2

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Record
CVE-2021-23337
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
OSVAZL-44655 7.2

CVE-2021-23337 affecting package js-jquery 3.5.0-4

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Record
AZL-44655
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-05
OSV 7.2

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Record
CVE-2021-23337
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 24 moreShow less
OSVDEBIAN-CVE-2021-23337 7.2

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Record
DEBIAN-CVE-2021-23337
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-35jh-r3h4-6jhm 7.2

Command Injection in lodash

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Record
GHSA-35jh-r3h4-6jhm
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77, CWE-94
Updated
2026-11-02
OSVRHSA-2021:2179 7.2

Red Hat Security Advisory: RHV Manager security update (ovirt-engine) [ovirt-4.4.6]

Record
RHSA-2021:2179
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2021:3459 7.2

Red Hat Security Advisory: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.8]

Record
RHSA-2021:3459
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2021-23337 7.2

CVE-2021-23337 in lodash.template - Patched by Root

Root has patched CVE-2021-23337 in the lodash.template package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2021-23337
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-06
OSVUBUNTU-CVE-2021-23337 7.2

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Record
UBUNTU-CVE-2021-23337
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVCLSA-2026-1773188140 No score

TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 3.10.1-tuxcare.2.

Record
CLSA-2026-1773188140
Updated
2026-11-02
OSVCLSA-2026-1775003202 No score

TuxCare security update for lodash.template (1 CVE)

TuxCare rebuilt lodash.template to address 1 CVE. Fixed in 4.5.0-tuxcare.1.

Record
CLSA-2026-1775003202
Updated
2026-11-02
OSVCLSA-2026-1775262599 No score

TuxCare security update for 11 packages (4 CVEs)

TuxCare rebuilt 11 packages to address 4 CVEs. Fixed in 3.2.0-tuxcare.1.

Record
CLSA-2026-1775262599
Updated
2026-11-02
OSVCLSA-2026-1775262601 No score

TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 1.3.1-tuxcare.1.

Record
CLSA-2026-1775262601
Updated
2026-11-02
OSVCLSA-2026-1775262602 No score

TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 2.4.2-tuxcare.1.

Record
CLSA-2026-1775262602
Updated
2026-11-02
OSVCLSA-2026-1775262603 No score

TuxCare security update for 11 packages (2 CVEs)

TuxCare rebuilt 11 packages to address 2 CVEs. Fixed in 4.5.0-tuxcare.1.

Record
CLSA-2026-1775262603
Updated
2026-11-02
OSVCLSA-2026-1775262615 No score

TuxCare security update for lodash (3 CVEs)

TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.15-tuxcare.5.

Record
CLSA-2026-1775262615
Updated
2026-11-02
OSVCLSA-2026-1777336764 No score

TuxCare security update for lodash (6 CVEs)

TuxCare rebuilt lodash to address 6 CVEs. Fixed in 4.18.1-tuxcare.1.

Record
CLSA-2026-1777336764
Updated
2026-11-02
OSVCLSA-2026-1784250520 No score

TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.11-tuxcare.1.

Record
CLSA-2026-1784250520
Updated
2026-11-02
OSVCLSA-2026-1784509817 No score

TuxCare security update for lodash (3 CVEs)

TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.5-tuxcare.2.

Record
CLSA-2026-1784509817
Updated
2026-11-02
OSVCLSA-2026-1784596286 No score

TuxCare security update for lodash (5 CVEs)

TuxCare rebuilt lodash to address 5 CVEs. Fixed in 4.17.4-tuxcare.3.

Record
CLSA-2026-1784596286
Updated
2026-11-02
OSVCLSA-2026-1784682758 No score

TuxCare security update for lodash.template (1 CVE)

TuxCare rebuilt lodash.template to address 1 CVE. Fixed in 4.4.0-tuxcare.1.

Record
CLSA-2026-1784682758
Updated
2026-11-02
OSVCLSA-2026-1785468076 No score

TuxCare security update for lodash-es (7 CVEs)

TuxCare rebuilt lodash-es to address 7 CVEs. Fixed in 4.17.11-tuxcare.1.

Record
CLSA-2026-1785468076
Updated
2026-11-02
OSVCLSA-2026-1785468082 No score

TuxCare security update for lodash-es (6 CVEs)

TuxCare rebuilt lodash-es to address 6 CVEs. Fixed in 4.17.15-tuxcare.1.

Record
CLSA-2026-1785468082
Updated
2026-11-02
OSVCLSA-2026-1791290323 No score

TuxCare security update for lodash (3 CVEs)

TuxCare rebuilt lodash to address 3 CVEs. Fixed in 2.3.0-tuxcare.1.

Record
CLSA-2026-1791290323
Updated
2026-11-02
OSVCLSA-2026-1791293623 No score

TuxCare security update for lodash (4 CVEs)

TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.23-tuxcare.1.

Record
CLSA-2026-1791293623
Updated
2026-11-02
OSVCLSA-2026-1792869760 No score

TuxCare security update for lodash.isequal (7 CVEs)

TuxCare rebuilt lodash.isequal to address 7 CVEs. Fixed in 4.5.0-tuxcare.9.

Record
CLSA-2026-1792869760
Updated
2026-11-02
OSVUSN-8411-1 No score

node-lodash vulnerabilities

It was discovered that Lodash was vulnerable to a prototype pollution issue in the zipObjectDeep function. An attacker could possibly use this issue to modify application behavior. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8203)

Liyuan Chen discovered that Lodash was vulnerable to a regular expression denial of service issue in the toNumber, trim, and trimEnd functions. An attacker could possibly use this issue to consume excessive system resources, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-28500)

Marc Hassan discovered that Lodash did not properly sanitize input to the template function. An attacker could possibly use this issue to inject and execute arbitrary commands. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-23337)

It was discovered that Lodash was vulnerable to a prototype pollution issue in the unset and omit functions. An attacker could possibly use this issue to delete properties from global prototypes, resulting in security restrictions being bypassed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. (CVE-2025-13465)

It was discovered that Lodash was vulnerable to a prototype pollution issue in the unset and omit functions. An attacker could possibly use this issue to delete properties from built-in prototypes, resulting in security restrictions being bypassed. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu 25.10, and Ubuntu 26.04 LTS. (CVE-2026-2950)

It was discovered that Lodash did not properly validate certain inputs to the template function. An attacker could possibly use this issue to inject malicious code during template processing, resulting in arbitrary code execution. (CVE-2026-4800)

Record
USN-8411-1
Updated
2026-11-02

Affected products

Show 11 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
lodash
npm
 before 4.17.21
4.17.21
lodash-es
npm
 before 4.17.21
4.17.21
lodash.template
npm
 through 4.5.0 None known
lodash-template
npm
 through 1.0.0 None known
lodash-rails
RubyGems
 before 4.17.21
4.17.21
js-jquery
Azure Linux:3
 through 3.5.0-4 None known
lodash
TuxCare:npm
From an advisory covering 5 CVEs
 3.10.1-tuxcare.0 up to 3.10.1-tuxcare.2, plus listed versions
3.10.13.10.1-tuxcare.1
3.10.1-tuxcare.2
lodash.template
TuxCare:npm
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash._basematches
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
Show 57 moreShow less
Affected packages
PackageAffectedFixed
lodash._createwrapper
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.endswith
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.escape
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.isplainobject
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.parseint
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.startswith
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.unescape
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.uniqueid
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash.words
TuxCare:npm
From an advisory covering 4 CVEs
 3.2.0-tuxcare.0 up to 3.2.0-tuxcare.1, plus listed versions
3.2.0
3.2.0-tuxcare.1
lodash
TuxCare:npm
From an advisory covering 4 CVEs
 1.3.1-tuxcare.0 up to 1.3.1-tuxcare.1, plus listed versions
1.3.1
1.3.1-tuxcare.1
lodash
TuxCare:npm
From an advisory covering 4 CVEs
 2.4.2-tuxcare.0 up to 2.4.2-tuxcare.1, plus listed versions
2.4.2
2.4.2-tuxcare.1
lodash
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash.clone
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash.clonedeep
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash.clonedeepwith
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash.difference
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash.flatmap
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash.foreach
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash.isequal
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash.uniq
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash.uniqwith
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash.xor
TuxCare:npm
From an advisory covering 2 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.1, plus listed versions
4.5.0
4.5.0-tuxcare.1
lodash
TuxCare:npm
From an advisory covering 3 CVEs
 4.17.15-tuxcare.0 up to 4.17.15-tuxcare.5, plus listed versions
4.17.154.17.15-tuxcare.14.17.15-tuxcare.24.17.15-tuxcare.34.17.15-tuxcare.4
4.17.15-tuxcare.5
lodash
TuxCare:npm
From an advisory covering 6 CVEs
 4.18.1-tuxcare.0 up to 4.18.1-tuxcare.1, plus listed versions
4.18.1
4.18.1-tuxcare.1
lodash
TuxCare:npm
From an advisory covering 4 CVEs
 4.17.11-tuxcare.0 up to 4.17.11-tuxcare.1, plus listed versions
4.17.11
4.17.11-tuxcare.1
lodash
TuxCare:npm
From an advisory covering 3 CVEs
 4.17.5-tuxcare.0 up to 4.17.5-tuxcare.2, plus listed versions
4.17.54.17.5-tuxcare.1
4.17.5-tuxcare.2
lodash
TuxCare:npm
From an advisory covering 5 CVEs
 4.17.4-tuxcare.0 up to 4.17.4-tuxcare.3, plus listed versions
4.17.44.17.4-tuxcare.14.17.4-tuxcare.2
4.17.4-tuxcare.3
lodash.template
TuxCare:npm
 4.4.0-tuxcare.0 up to 4.4.0-tuxcare.1, plus listed versions
4.4.0
4.4.0-tuxcare.1
lodash-es
TuxCare:npm
From an advisory covering 7 CVEs
 4.17.11-tuxcare.0 up to 4.17.11-tuxcare.1, plus listed versions
4.17.11
4.17.11-tuxcare.1
lodash-es
TuxCare:npm
From an advisory covering 6 CVEs
 4.17.15-tuxcare.0 up to 4.17.15-tuxcare.1, plus listed versions
4.17.15
4.17.15-tuxcare.1
lodash
TuxCare:npm
From an advisory covering 3 CVEs
 2.3.0-tuxcare.0 up to 2.3.0-tuxcare.1, plus listed versions
2.3.0
2.3.0-tuxcare.1
lodash
TuxCare:npm
From an advisory covering 4 CVEs
 4.17.23-tuxcare.0 up to 4.17.23-tuxcare.1, plus listed versions
4.17.23
4.17.23-tuxcare.1
lodash.isequal
TuxCare:npm
From an advisory covering 7 CVEs
 4.5.0-tuxcare.0 up to 4.5.0-tuxcare.9, plus listed versions
4.5.04.5.0-tuxcare.74.5.0-tuxcare.8
4.5.0-tuxcare.9
node-lodash
Debian:12
 before 4.17.21+dfsg+~cs8.31.173-1
4.17.21+dfsg+~cs8.31.173-1
node-lodash
Debian:13
 before 4.17.21+dfsg+~cs8.31.173-1
4.17.21+dfsg+~cs8.31.173-1
node-lodash
Debian:14
 before 4.17.21+dfsg+~cs8.31.173-1
4.17.21+dfsg+~cs8.31.173-1
lodash-rails
RubyGems
 before 4.17.21, plus listed versions
0.10.00.7.00.8.10.8.20.9.0
Show 45 moreShow less
0.9.10.9.21.0.0.rc.11.0.0.rc.21.0.0.rc.31.0.11.1.01.1.11.2.01.2.11.3.12.0.02.1.02.2.02.2.12.3.02.4.02.4.13.1.03.10.03.10.13.2.03.3.03.3.13.3.1.13.4.03.5.03.6.03.7.03.9.34.0.04.11.24.12.04.13.14.14.14.15.04.16.14.16.34.16.44.16.64.17.104.17.114.17.144.17.154.17.2
4.17.21
ovirt-engine-ui-extensions
Red Hat:rhev_manager:4.4:el8
From an advisory covering 2 CVEs
 before 0:1.2.6-1.el8ev
0:1.2.6-1.el8ev
ovirt-web-ui
Red Hat:rhev_manager:4.4:el8
From an advisory covering 2 CVEs
 before 0:1.6.9-1.el8ev
0:1.6.9-1.el8ev
cockpit-ovirt
Red Hat:rhev_hypervisor:4.4::el8
From an advisory covering 2 CVEs
 before 0:0.15.1-2.el8ev
0:0.15.1-2.el8ev
cockpit-ovirt-dashboard
Red Hat:rhev_hypervisor:4.4::el8
From an advisory covering 2 CVEs
 before 0:0.15.1-2.el8ev
0:0.15.1-2.el8ev
lodash.template
Root:npm
 before 4.5.0-aikido.2
4.5.0-aikido.24.5.0-aikido.34.5.0-aikido.4
lodash
Root:npm
 before 0.1.0-aikido.2
0.1.0-aikido.22.4.2-aikido.44.17.20-aikido.30.1.0-aikido.34.17.15-aikido.14.17.19-aikido.14.17.15-aikido.24.17.21-aikido.34.17.11-aikido.14.17.21-aikido.2
lodash-es
Root:npm
 before 4.17.15-aikido.1
4.17.15-aikido.14.17.15-aikido.24.17.21-aikido.4
@rootio/lodash.template
Root:npm
 before 4.5.0-root.io.1
4.5.0-root.io.14.5.0-root.io.24.5.0-root.io.34.5.0-root.io.4
@rootio/lodash
Root:npm
 before 2.4.2-root.io.3
2.4.2-root.io.34.17.20-root.io.14.17.20-root.io.20.1.0-root.io.10.1.0-root.io.22.4.2-root.io.44.17.20-root.io.30.1.0-root.io.34.17.15-root.io.14.17.19-root.io.14.17.15-root.io.24.17.21-root.io.34.17.11-root.io.14.17.21-root.io.24.17.21-root.io.1
@rootio/lodash-es
Root:npm
 before 4.17.15-root.io.1
4.17.15-root.io.14.17.15-root.io.24.17.21-root.io.14.17.21-root.io.24.17.21-root.io.34.17.21-root.io.4
node-lodash
Ubuntu:Pro:16.04:LTS
 before 2.4.1+dfsg-3ubuntu0.1~esm1, plus listed versions
2.4.1+dfsg-3
2.4.1+dfsg-3ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:18.04:LTS
 before 4.17.4+dfsg-1ubuntu0.1~esm1, plus listed versions
4.17.4+dfsg-1
4.17.4+dfsg-1ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:20.04:LTS
 before 4.17.15+dfsg-2ubuntu0.1~esm1, plus listed versions
4.17.11+dfsg-44.17.15+dfsg-2
4.17.15+dfsg-2ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:16.04:LTS
From an advisory covering 6 CVEs
 before 2.4.1+dfsg-3ubuntu0.1~esm1, plus listed versions
2.4.1+dfsg-3
2.4.1+dfsg-3ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:18.04:LTS
From an advisory covering 6 CVEs
 before 4.17.4+dfsg-1ubuntu0.1~esm1, plus listed versions
4.17.4+dfsg-1
4.17.4+dfsg-1ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:20.04:LTS
From an advisory covering 6 CVEs
 before 4.17.15+dfsg-2ubuntu0.1~esm1, plus listed versions
4.17.11+dfsg-44.17.15+dfsg-2
4.17.15+dfsg-2ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:22.04:LTS
From an advisory covering 6 CVEs
 before 4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1, plus listed versions
4.17.21+dfsg+~cs8.31.173-14.17.21+dfsg+~cs8.31.196.20210220-24.17.21+dfsg+~cs8.31.198.20210220-44.17.21+dfsg+~cs8.31.198.20210220-5
4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1
node-lodash
Ubuntu:Pro:24.04:LTS
From an advisory covering 6 CVEs
 before 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1, plus listed versions
4.17.21+dfsg+~cs8.31.198.20210220-9
4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1
node-lodash
Ubuntu:25.10
From an advisory covering 6 CVEs
 before 4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1, plus listed versions
4.17.21+dfsg+~cs8.31.198.20210220-9
4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1
node-lodash
Ubuntu:Pro:26.04:LTS
From an advisory covering 6 CVEs
 before 4.17.23+dfsg-1ubuntu0.1~esm1, plus listed versions
4.17.21+dfsg+~cs8.31.198.20210220-94.17.23+dfsg-1
4.17.23+dfsg-1ubuntu0.1~esm1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubkhayashi4337/lodash.template-fixed2026-03-01
NucleiLodash Template - Server-Side Template Injection (RCE)

History

History
RecordedChangedSources
affectedOSV
affectedOSV
affected
affected, exploits, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-23337 is a high vulnerability (CVSS 7.2) in Lodash, published February 15, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 21.3%, the 97th percentile. Fixed in lodash 4.17.21.

References

Show 74 moreShow less
This page doesn't list everything

Left out here: 5 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open