{"id":"CVE-2021-23337","aliases":["AZL-44655","CLSA-2026-1773188140","CLSA-2026-1775003202","CLSA-2026-1775262599","CLSA-2026-1775262601","CLSA-2026-1775262602","CLSA-2026-1775262603","CLSA-2026-1775262615","CLSA-2026-1777336764","CLSA-2026-1784250520","CLSA-2026-1784509817","CLSA-2026-1784596286","CLSA-2026-1784682758","CLSA-2026-1785468076","CLSA-2026-1785468082","CLSA-2026-1791290323","CLSA-2026-1791293623","CLSA-2026-1792869760","DEBIAN-CVE-2021-23337","EUVD-2021-0912","GHSA-35jh-r3h4-6jhm","RHSA-2021:2179","RHSA-2021:3459","ROOT-APP-NPM-CVE-2021-23337","UBUNTU-CVE-2021-23337","USN-8411-1"],"status":"published","title":"Command Injection","description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.21333,"percentile":0.97618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77","CWE-94"],"published":"2021-02-15T12:15:14Z","modified":"2026-11-06T12:15:03Z","exploits":[{"source":"pocgithub","id":"khayashi4337/lodash.template-fixed","title":"khayashi4337/lodash.template-fixed","date":"2026-03-01","url":"https://github.com/khayashi4337/lodash.template-fixed"},{"source":"nuclei","id":"CVE-2021-23337","title":"Lodash Template - Server-Side Template Injection (RCE)","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-23337.yaml"}],"fixes":[{"ecosystem":"npm","package":"lodash","fixed_in":["4.17.21"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"lodash-es","fixed_in":["4.17.21"],"sources":["ghsa","osv"]},{"ecosystem":"RubyGems","package":"lodash-rails","fixed_in":["4.17.21"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"lodash.template","fixed_in":["4.5.0-tuxcare.1","4.4.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"node-lodash","fixed_in":["4.17.21+dfsg+~cs8.31.173-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"node-lodash","fixed_in":["4.17.21+dfsg+~cs8.31.173-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-lodash","fixed_in":["4.17.21+dfsg+~cs8.31.173-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"lodash.template","fixed_in":["4.5.0-aikido.2","4.5.0-aikido.3","4.5.0-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"lodash","fixed_in":["0.1.0-aikido.2","2.4.2-aikido.4","4.17.20-aikido.3","0.1.0-aikido.3","4.17.15-aikido.1","4.17.19-aikido.1","4.17.15-aikido.2","4.17.21-aikido.3","4.17.11-aikido.1","4.17.21-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"lodash-es","fixed_in":["4.17.15-aikido.1","4.17.15-aikido.2","4.17.21-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/lodash.template","fixed_in":["4.5.0-root.io.1","4.5.0-root.io.2","4.5.0-root.io.3","4.5.0-root.io.4"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/lodash","fixed_in":["2.4.2-root.io.3","4.17.20-root.io.1","4.17.20-root.io.2","0.1.0-root.io.1","0.1.0-root.io.2","2.4.2-root.io.4","4.17.20-root.io.3","0.1.0-root.io.3","4.17.15-root.io.1","4.17.19-root.io.1","4.17.15-root.io.2","4.17.21-root.io.3","4.17.11-root.io.1","4.17.21-root.io.2","4.17.21-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/lodash-es","fixed_in":["4.17.15-root.io.1","4.17.15-root.io.2","4.17.21-root.io.1","4.17.21-root.io.2","4.17.21-root.io.3","4.17.21-root.io.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-lodash","fixed_in":["2.4.1+dfsg-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-lodash","fixed_in":["4.17.4+dfsg-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-lodash","fixed_in":["4.17.15+dfsg-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21"}]}]},{"source":"ghsa","ecosystem":"npm","package":"lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21"}]}]},{"source":"ghsa","ecosystem":"npm","package":"lodash.template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.5.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"lodash-template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.0"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"lodash-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"js-jquery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.5.0-4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.10.1-tuxcare.0"},{"fixed":"3.10.1-tuxcare.2"}]}],"versions":["3.10.1","3.10.1-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash._basematches","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash._createwrapper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.endswith","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.escape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.isplainobject","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.parseint","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.startswith","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.unescape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.uniqueid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.words","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0-tuxcare.0"},{"fixed":"3.2.0-tuxcare.1"}]}],"versions":["3.2.0"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.3.1-tuxcare.0"},{"fixed":"1.3.1-tuxcare.1"}]}],"versions":["1.3.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.2-tuxcare.0"},{"fixed":"2.4.2-tuxcare.1"}]}],"versions":["2.4.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.clone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.clonedeep","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.clonedeepwith","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.difference","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.flatmap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.foreach","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.isequal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.uniq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.uniqwith","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.xor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.1"}]}],"versions":["4.5.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.15-tuxcare.0"},{"fixed":"4.17.15-tuxcare.5"}]}],"versions":["4.17.15","4.17.15-tuxcare.1","4.17.15-tuxcare.2","4.17.15-tuxcare.3","4.17.15-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.18.1-tuxcare.0"},{"fixed":"4.18.1-tuxcare.1"}]}],"versions":["4.18.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.11-tuxcare.0"},{"fixed":"4.17.11-tuxcare.1"}]}],"versions":["4.17.11"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.5-tuxcare.0"},{"fixed":"4.17.5-tuxcare.2"}]}],"versions":["4.17.5","4.17.5-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.4-tuxcare.0"},{"fixed":"4.17.4-tuxcare.3"}]}],"versions":["4.17.4","4.17.4-tuxcare.1","4.17.4-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.4.0-tuxcare.0"},{"fixed":"4.4.0-tuxcare.1"}]}],"versions":["4.4.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.11-tuxcare.0"},{"fixed":"4.17.11-tuxcare.1"}]}],"versions":["4.17.11"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.15-tuxcare.0"},{"fixed":"4.17.15-tuxcare.1"}]}],"versions":["4.17.15"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0-tuxcare.0"},{"fixed":"2.3.0-tuxcare.1"}]}],"versions":["2.3.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.17.23-tuxcare.0"},{"fixed":"4.17.23-tuxcare.1"}]}],"versions":["4.17.23"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"lodash.isequal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.9"}]}],"versions":["4.5.0","4.5.0-tuxcare.7","4.5.0-tuxcare.8"],"bundled":7},{"source":"osv","ecosystem":"Debian:12","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.173-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.173-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.173-1"}]}]},{"source":"osv","ecosystem":"npm","package":"lodash","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.17.21"}]}]},{"source":"osv","ecosystem":"npm","package":"lodash-es","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.17.21"}]}]},{"source":"osv","ecosystem":"npm","package":"lodash.template","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"4.5.0"}]}]},{"source":"osv","ecosystem":"npm","package":"lodash-template","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.0.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"lodash-rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21"}]}],"versions":["0.10.0","0.7.0","0.8.1","0.8.2","0.9.0","0.9.1","0.9.2","1.0.0.rc.1","1.0.0.rc.2","1.0.0.rc.3","1.0.1","1.1.0","1.1.1","1.2.0","1.2.1","1.3.1","2.0.0","2.1.0","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","3.1.0","3.10.0","3.10.1","3.2.0","3.3.0","3.3.1","3.3.1.1","3.4.0","3.5.0","3.6.0","3.7.0","3.9.3","4.0.0","4.11.2","4.12.0","4.13.1","4.14.1","4.15.0","4.16.1","4.16.3","4.16.4","4.16.6","4.17.10","4.17.11","4.17.14","4.17.15","4.17.2","4.17.4","4.17.5","4.3.0","4.5.1","4.6.1"]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-ui-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.6-1.el8ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-web-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.9-1.el8ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"cockpit-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.1-2.el8ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_hypervisor:4.4::el8","package":"cockpit-ovirt-dashboard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.15.1-2.el8ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:npm","package":"lodash.template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-aikido.2"},{"fixed":"4.5.0-aikido.3"},{"fixed":"4.5.0-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.0-aikido.2"},{"fixed":"2.4.2-aikido.4"},{"fixed":"4.17.20-aikido.3"},{"fixed":"0.1.0-aikido.3"},{"fixed":"4.17.15-aikido.1"},{"fixed":"4.17.19-aikido.1"},{"fixed":"4.17.15-aikido.2"},{"fixed":"4.17.21-aikido.3"},{"fixed":"4.17.11-aikido.1"},{"fixed":"4.17.21-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.15-aikido.1"},{"fixed":"4.17.15-aikido.2"},{"fixed":"4.17.21-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/lodash.template","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.0-root.io.1"},{"fixed":"4.5.0-root.io.2"},{"fixed":"4.5.0-root.io.3"},{"fixed":"4.5.0-root.io.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.2-root.io.3"},{"fixed":"4.17.20-root.io.1"},{"fixed":"4.17.20-root.io.2"},{"fixed":"0.1.0-root.io.1"},{"fixed":"0.1.0-root.io.2"},{"fixed":"2.4.2-root.io.4"},{"fixed":"4.17.20-root.io.3"},{"fixed":"0.1.0-root.io.3"},{"fixed":"4.17.15-root.io.1"},{"fixed":"4.17.19-root.io.1"},{"fixed":"4.17.15-root.io.2"},{"fixed":"4.17.21-root.io.3"},{"fixed":"4.17.11-root.io.1"},{"fixed":"4.17.21-root.io.2"},{"fixed":"4.17.21-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/lodash-es","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.15-root.io.1"},{"fixed":"4.17.15-root.io.2"},{"fixed":"4.17.21-root.io.1"},{"fixed":"4.17.21-root.io.2"},{"fixed":"4.17.21-root.io.3"},{"fixed":"4.17.21-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1+dfsg-3ubuntu0.1~esm1"}]}],"versions":["2.4.1+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4+dfsg-1ubuntu0.1~esm1"}]}],"versions":["4.17.4+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.15+dfsg-2ubuntu0.1~esm1"}]}],"versions":["4.17.11+dfsg-4","4.17.15+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1+dfsg-3ubuntu0.1~esm1"}]}],"versions":["2.4.1+dfsg-3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.4+dfsg-1ubuntu0.1~esm1"}]}],"versions":["4.17.4+dfsg-1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.15+dfsg-2ubuntu0.1~esm1"}]}],"versions":["4.17.11+dfsg-4","4.17.15+dfsg-2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-5ubuntu0.1~esm1"}]}],"versions":["4.17.21+dfsg+~cs8.31.173-1","4.17.21+dfsg+~cs8.31.196.20210220-2","4.17.21+dfsg+~cs8.31.198.20210220-4","4.17.21+dfsg+~cs8.31.198.20210220-5"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.24.04.1~esm1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"node-lodash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.17.23+dfsg-1ubuntu0.1~esm1"}]}],"versions":["4.17.21+dfsg+~cs8.31.198.20210220-9","4.17.23+dfsg-1"],"bundled":6}],"products":[{"vendor":"lodash","product":"lodash"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"cloud_manager"},{"vendor":"netapp","product":"system_manager"},{"vendor":"oracle","product":"banking_corporate_lending_process_management"},{"vendor":"oracle","product":"banking_credit_facilities_process_management"},{"vendor":"oracle","product":"banking_extensibility_workbench"},{"vendor":"oracle","product":"banking_supply_chain_finance"},{"vendor":"oracle","product":"banking_trade_finance_process_management"},{"vendor":"oracle","product":"communications_cloud_native_core_binding_support_function"},{"vendor":"oracle","product":"communications_cloud_native_core_policy"},{"vendor":"oracle","product":"communications_design_studio"},{"vendor":"oracle","product":"communications_services_gatekeeper"},{"vendor":"oracle","product":"communications_session_border_controller"},{"vendor":"oracle","product":"enterprise_communications_broker"},{"vendor":"oracle","product":"financial_services_crime_and_compliance_management_studio"},{"vendor":"oracle","product":"health_sciences_data_management_workbench"},{"vendor":"oracle","product":"jd_edwards_enterpriseone_tools"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"oracle","product":"primavera_gateway"},{"vendor":"oracle","product":"primavera_unifier"},{"vendor":"oracle","product":"retail_customer_management_and_segmentation_foundation"},{"vendor":"siemens","product":"sinec_ins"}],"references":[{"url":"https://snyk.io/vuln/SNYK-JS-LODASH-1040724","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","article","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","tags":["x_refsource_MISC","x_transferred","Broken Link","web","report"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://security.netapp.com/advisory/ntap-20210312-0006/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","tags":["web","advisory"]},{"url":"https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","tags":["web"]},{"url":"https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20210312-0006","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-23337","tags":["advisory"]},{"url":"https://github.com/lodash/lodash","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2179","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1113630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1310330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1589763","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1621421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717411","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1766414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775145","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1821199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845877","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1875363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1906074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1910858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1917718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1919984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1924610","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1926018","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1926823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928188","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1928954","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1929211","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1930895","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1932284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1935073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1942083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943267","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1944723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1948577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1949543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1949547","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1950348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1950466","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1954401","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2179.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-28500","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28500","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28500","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-LODASH-1018905","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-23337","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-23337","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:3459","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1948177","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1984209","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998017","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3459.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-23337","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8411-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8203","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-28500","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-13465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-2950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-4800","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-23337","title":"Command Injection","description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","status":"published","published":"2021-02-15T12:15:14.715Z","modified":"2026-10-08T21:13:55.84Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.488332Z"}],"euvd":[{"id":"EUVD-2021-0912","description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","status":"published","published":"2021-02-15T12:15:14Z","modified":"2026-10-08T21:13:55Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C","level":"high"}],"updated_at":"2026-11-02T17:27:26.452288Z"}],"ghsa":[{"id":"GHSA-35jh-r3h4-6jhm","title":"Command Injection in lodash","description":"`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","status":"published","published":"2021-05-06T16:05:51Z","modified":"2025-08-12T21:44:25Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-94"],"updated_at":"2026-11-02T14:38:53.767052Z"}],"nvd":[{"id":"CVE-2021-23337","description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","status":"published","published":"2021-02-15T13:15:12.56Z","modified":"2026-10-08T22:17:07.363Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:06:50.031227Z"}],"osv":[{"id":"AZL-44655","title":"CVE-2021-23337 affecting package js-jquery 3.5.0-4","description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","status":"published","published":"2021-02-15T13:15:12Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2021-23337","description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","status":"published","published":"2021-02-15T13:15:12.56Z","modified":"2026-10-24T10:30:48.714407739Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-23337","description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","status":"published","published":"2021-02-15T13:15:12.56Z","modified":"2026-10-09T09:47:28.354433475Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-35jh-r3h4-6jhm","title":"Command Injection in lodash","description":"`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","status":"published","published":"2021-05-06T16:05:51Z","modified":"2026-10-17T02:55:38.085813876Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77","CWE-94"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"RHSA-2021:2179","title":"Red Hat Security Advisory: RHV Manager security update (ovirt-engine) [ovirt-4.4.6]","status":"published","published":"2024-09-14T00:42:53Z","modified":"2026-10-09T10:02:25Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:3459","title":"Red Hat Security Advisory: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.8]","status":"published","published":"2024-09-14T00:42:46Z","modified":"2026-10-09T10:02:47Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"ROOT-APP-NPM-CVE-2021-23337","title":"CVE-2021-23337 in lodash.template - Patched by Root","description":"Root has patched CVE-2021-23337 in the lodash.template package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-06T11:33:56Z","modified":"2026-11-06T12:15:03.80644093Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-06T12:43:06.926783Z"},{"id":"UBUNTU-CVE-2021-23337","description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","status":"published","published":"2021-02-15T13:15:00Z","modified":"2026-06-09T21:15:39.452313261Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"CLSA-2026-1773188140","title":"TuxCare security update for lodash (5 CVEs)","description":"TuxCare rebuilt lodash to address 5 CVEs. Fixed in 3.10.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:12Z","modified":"2026-10-15T09:47:28.750221767Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1775003202","title":"TuxCare security update for lodash.template (1 CVE)","description":"TuxCare rebuilt lodash.template to address 1 CVE. Fixed in 4.5.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:19Z","modified":"2026-10-15T09:47:48.883312877Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775262599","title":"TuxCare security update for 11 packages (4 CVEs)","description":"TuxCare rebuilt 11 packages to address 4 CVEs. Fixed in 3.2.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-15T09:47:06.815991036Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775262601","title":"TuxCare security update for lodash (4 CVEs)","description":"TuxCare rebuilt lodash to address 4 CVEs. Fixed in 1.3.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-15T09:47:06.489173154Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775262602","title":"TuxCare security update for lodash (4 CVEs)","description":"TuxCare rebuilt lodash to address 4 CVEs. Fixed in 2.4.2-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-15T09:47:06.692717222Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775262603","title":"TuxCare security update for 11 packages (2 CVEs)","description":"TuxCare rebuilt 11 packages to address 2 CVEs. Fixed in 4.5.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-15T09:47:06.804557638Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775262615","title":"TuxCare security update for lodash (3 CVEs)","description":"TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.15-tuxcare.5.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-15T09:47:06.791910697Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777336764","title":"TuxCare security update for lodash (6 CVEs)","description":"TuxCare rebuilt lodash to address 6 CVEs. Fixed in 4.18.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-15T09:45:51.099319726Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1784250520","title":"TuxCare security update for lodash (4 CVEs)","description":"TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:44Z","modified":"2026-10-15T09:47:36.054284014Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784509817","title":"TuxCare security update for lodash (3 CVEs)","description":"TuxCare rebuilt lodash to address 3 CVEs. Fixed in 4.17.5-tuxcare.2.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:45:58.690045165Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1784596286","title":"TuxCare security update for lodash (5 CVEs)","description":"TuxCare rebuilt lodash to address 5 CVEs. Fixed in 4.17.4-tuxcare.3.","status":"published","published":"2026-08-04T14:52:45Z","modified":"2026-10-15T09:47:54.114496471Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1784682758","title":"TuxCare security update for lodash.template (1 CVE)","description":"TuxCare rebuilt lodash.template to address 1 CVE. Fixed in 4.4.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:46Z","modified":"2026-10-15T09:47:54.073288617Z","updated_at":"2026-11-02T15:43:46.482572Z"},{"id":"CLSA-2026-1785468076","title":"TuxCare security update for lodash-es (7 CVEs)","description":"TuxCare rebuilt lodash-es to address 7 CVEs. Fixed in 4.17.11-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:59.090246645Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1785468082","title":"TuxCare security update for lodash-es (6 CVEs)","description":"TuxCare rebuilt lodash-es to address 6 CVEs. Fixed in 4.17.15-tuxcare.1.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-10-15T09:45:58.182619085Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1791290323","title":"TuxCare security update for lodash (3 CVEs)","description":"TuxCare rebuilt lodash to address 3 CVEs. Fixed in 2.3.0-tuxcare.1.","status":"published","published":"2026-10-06T12:38:43Z","modified":"2026-10-15T09:47:58.405045316Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791293623","title":"TuxCare security update for lodash (4 CVEs)","description":"TuxCare rebuilt lodash to address 4 CVEs. Fixed in 4.17.23-tuxcare.1.","status":"published","published":"2026-10-06T13:33:43Z","modified":"2026-10-15T09:47:39.675539064Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792869760","title":"TuxCare security update for lodash.isequal (7 CVEs)","description":"TuxCare rebuilt lodash.isequal to address 7 CVEs. Fixed in 4.5.0-tuxcare.9.","status":"published","published":"2026-10-24T19:22:40Z","modified":"2026-10-25T01:30:08.216799665Z","updated_at":"2026-11-02T15:43:54.981307Z"},{"id":"USN-8411-1","title":"node-lodash vulnerabilities","description":"It was discovered that Lodash was vulnerable to a prototype pollution\nissue in the zipObjectDeep function. An attacker could possibly use this\nissue to modify application behavior. This issue only affected Ubuntu\n18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-8203)\n\nLiyuan Chen discovered that Lodash was vulnerable to a regular\nexpression denial of service issue in the toNumber, trim, and trimEnd\nfunctions. An attacker could possibly use this issue to consume\nexcessive system resources, resulting in a denial of service. This issue\nonly affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-28500)\n\nMarc Hassan discovered that Lodash did not properly sanitize input to\nthe template function. An attacker could possibly use this issue to\ninject and execute arbitrary commands. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2021-23337)\n\nIt was discovered that Lodash was vulnerable to a prototype pollution\nissue in the unset and omit functions. An attacker could possibly use\nthis issue to delete properties from global prototypes, resulting in\nsecurity restrictions being bypassed. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and\nUbuntu 25.10. (CVE-2025-13465)\n\nIt was discovered that Lodash was vulnerable to a prototype pollution\nissue in the unset and omit functions. An attacker could possibly use\nthis issue to delete properties from built-in prototypes, resulting in\nsecurity restrictions being bypassed. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, Ubuntu\n25.10, and Ubuntu 26.04 LTS. (CVE-2026-2950)\n\nIt was discovered that Lodash did not properly validate certain inputs\nto the template function. An attacker could possibly use this issue to\ninject malicious code during template processing, resulting in arbitrary\ncode execution. (CVE-2026-4800)","status":"published","published":"2026-06-09T15:16:59Z","modified":"2026-10-27T04:17:21.778951643Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}