CVE-2021-23337High· 7.2▾ MidnightPoC availableLodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 39.6 · likelihood 4.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 2 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
21%
1 GitHub repo · Nuclei ×1 (last check)
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
lodash < 4.17.21banking_corporate_lending_process_management = 14.2.0banking_corporate_lending_process_management = 14.3.0banking_corporate_lending_process_management = 14.5.0banking_credit_facilities_process_management = 14.2.0banking_credit_facilities_process_management = 14.3.0banking_credit_facilities_process_management = 14.5.0banking_extensibility_workbench = 14.2.0banking_extensibility_workbench = 14.3.0banking_extensibility_workbench = 14.5.0banking_supply_chain_finance = 14.2.0banking_supply_chain_finance = 14.3.0banking_supply_chain_finance = 14.5.0banking_trade_finance_process_management = 14.2.0banking_trade_finance_process_management = 14.3.0banking_trade_finance_process_management = 14.5.0communications_cloud_native_core_binding_support_function = 1.9.0communications_cloud_native_core_policy = 1.11.0communications_design_studio = 7.4.2.0.0communications_services_gatekeeper = 7.0communications_session_border_controller = 8.4communications_session_border_controller = 9.0enterprise_communications_broker = 3.2.0enterprise_communications_broker = 3.3.0financial_services_crime_and_compliance_management_studio = 8.0.8.2.0financial_services_crime_and_compliance_management_studio = 8.0.8.3.0health_sciences_data_management_workbench = 2.5.2.1health_sciences_data_management_workbench = 3.0.0.0jd_edwards_enterpriseone_tools < 9.2.6.1peoplesoft_enterprise_peopletools = 8.58peoplesoft_enterprise_peopletools = 8.59primavera_gateway >= 17.12.0, <= 17.12.11primavera_gateway >= 18.8.0, <= 18.8.12primavera_gateway >= 19.12.0, <= 19.12.11primavera_gateway >= 20.12.0, <= 20.12.7primavera_unifier >= 17.7, <= 17.12primavera_unifier = 18.8primavera_unifier = 19.12primavera_unifier = 20.12retail_customer_management_and_segmentation_foundation = 19.0active_iq_unified_managercloud_managersystem_manager = 9.0sinec_ins < 1.0sinec_ins = 1.0Upgrade past the affected range:
lodash 4.17.21jd_edwards_enterpriseone_tools 9.2.6.1sinec_ins 1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2020-28500Medium· 5.3Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
CVE-2021-21345Medium· 5.8XStream is a Java library to serialize objects to XML and back again
CVE-2020-26217High· 8.0XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream
CVE-2026-2950Medium· 6.5The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution
CVE-2020-7712High· 7.2This affects the package json before 10.0.0
CVE-2026-4800High· 8.1The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink