--- id: CVE-2021-23337 title: >- Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. summary: >- Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. severity: high cvss: 7.2 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-94 - CWE-78 vendor: lodash product: lodash affected: - lodash < 4.17.21 - banking_corporate_lending_process_management = 14.2.0 - banking_corporate_lending_process_management = 14.3.0 - banking_corporate_lending_process_management = 14.5.0 - banking_credit_facilities_process_management = 14.2.0 - banking_credit_facilities_process_management = 14.3.0 - banking_credit_facilities_process_management = 14.5.0 - banking_extensibility_workbench = 14.2.0 - banking_extensibility_workbench = 14.3.0 - banking_extensibility_workbench = 14.5.0 - banking_supply_chain_finance = 14.2.0 - banking_supply_chain_finance = 14.3.0 - banking_supply_chain_finance = 14.5.0 - banking_trade_finance_process_management = 14.2.0 - banking_trade_finance_process_management = 14.3.0 - banking_trade_finance_process_management = 14.5.0 - communications_cloud_native_core_binding_support_function = 1.9.0 - communications_cloud_native_core_policy = 1.11.0 - communications_design_studio = 7.4.2.0.0 - communications_services_gatekeeper = 7.0 - communications_session_border_controller = 8.4 - communications_session_border_controller = 9.0 - enterprise_communications_broker = 3.2.0 - enterprise_communications_broker = 3.3.0 - financial_services_crime_and_compliance_management_studio = 8.0.8.2.0 - financial_services_crime_and_compliance_management_studio = 8.0.8.3.0 - health_sciences_data_management_workbench = 2.5.2.1 - health_sciences_data_management_workbench = 3.0.0.0 - jd_edwards_enterpriseone_tools < 9.2.6.1 - peoplesoft_enterprise_peopletools = 8.58 - peoplesoft_enterprise_peopletools = 8.59 - 'primavera_gateway >= 17.12.0, <= 17.12.11' - 'primavera_gateway >= 18.8.0, <= 18.8.12' - 'primavera_gateway >= 19.12.0, <= 19.12.11' - 'primavera_gateway >= 20.12.0, <= 20.12.7' - 'primavera_unifier >= 17.7, <= 17.12' - primavera_unifier = 18.8 - primavera_unifier = 19.12 - primavera_unifier = 20.12 - retail_customer_management_and_segmentation_foundation = 19.0 - active_iq_unified_manager - cloud_manager - system_manager = 9.0 - sinec_ins < 1.0 - sinec_ins = 1.0 patched: - lodash 4.17.21 - jd_edwards_enterpriseone_tools 9.2.6.1 - sinec_ins 1.0 published: '2021-02-15' updated: '2026-10-08' sourceUpdated: '2026-10-08T22:17:07.363' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-23337' references: - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf' label: report@snyk.io - url: >- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851 label: report@snyk.io - url: 'https://security.netapp.com/advisory/ntap-20210312-0006/' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JS-LODASH-1040724' label: report@snyk.io - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: report@snyk.io - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: report@snyk.io - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: report@snyk.io - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: report@snyk.io - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851 label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20210312-0006/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JS-LODASH-1040724' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-23337.json - url: 'https://access.redhat.com/security/cve/CVE-2021-23337' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1928937' - url: 'https://www.cve.org/CVERecord?id=CVE-2021-23337' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-23337' - url: 'https://access.redhat.com/errata/RHSA-2021:2543' - url: 'https://access.redhat.com/errata/RHSA-2022:6429' - url: 'https://access.redhat.com/errata/RHSA-2021:2438' - url: 'https://access.redhat.com/errata/RHSA-2021:3459' - url: 'https://access.redhat.com/errata/RHSA-2021:2179' - url: 'https://access.redhat.com/errata/RHSA-2026:7329' tags: - nvd - exploit-available - csaf - vex - red-hat - cve.org epss: 0.21333 epssPercentile: 0.97588 exploits: github: 1 githubRepos: - 'https://github.com/khayashi4337/lodash.template-fixed' nuclei: - CVE-2021-23337 checkedAt: '2026-10-27T16:39:23.991Z' exploitAvailable: true ingestedAt: '2026-10-08T23:16:47.314Z' ssvc: exploitation: none automatable: 'yes' technicalImpact: total timestamp: '2026-10-08T21:08:30.418276Z' --- ## Overview Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. ## Affected - `lodash < 4.17.21` - `banking_corporate_lending_process_management = 14.2.0` - `banking_corporate_lending_process_management = 14.3.0` - `banking_corporate_lending_process_management = 14.5.0` - `banking_credit_facilities_process_management = 14.2.0` - `banking_credit_facilities_process_management = 14.3.0` - `banking_credit_facilities_process_management = 14.5.0` - `banking_extensibility_workbench = 14.2.0` - `banking_extensibility_workbench = 14.3.0` - `banking_extensibility_workbench = 14.5.0` - `banking_supply_chain_finance = 14.2.0` - `banking_supply_chain_finance = 14.3.0` - `banking_supply_chain_finance = 14.5.0` - `banking_trade_finance_process_management = 14.2.0` - `banking_trade_finance_process_management = 14.3.0` - `banking_trade_finance_process_management = 14.5.0` - `communications_cloud_native_core_binding_support_function = 1.9.0` - `communications_cloud_native_core_policy = 1.11.0` - `communications_design_studio = 7.4.2.0.0` - `communications_services_gatekeeper = 7.0` - `communications_session_border_controller = 8.4` - `communications_session_border_controller = 9.0` - `enterprise_communications_broker = 3.2.0` - `enterprise_communications_broker = 3.3.0` - `financial_services_crime_and_compliance_management_studio = 8.0.8.2.0` - `financial_services_crime_and_compliance_management_studio = 8.0.8.3.0` - `health_sciences_data_management_workbench = 2.5.2.1` - `health_sciences_data_management_workbench = 3.0.0.0` - `jd_edwards_enterpriseone_tools < 9.2.6.1` - `peoplesoft_enterprise_peopletools = 8.58` - `peoplesoft_enterprise_peopletools = 8.59` - `primavera_gateway >= 17.12.0, <= 17.12.11` - `primavera_gateway >= 18.8.0, <= 18.8.12` - `primavera_gateway >= 19.12.0, <= 19.12.11` - `primavera_gateway >= 20.12.0, <= 20.12.7` - `primavera_unifier >= 17.7, <= 17.12` - `primavera_unifier = 18.8` - `primavera_unifier = 19.12` - `primavera_unifier = 20.12` - `retail_customer_management_and_segmentation_foundation = 19.0` - `active_iq_unified_manager` - `cloud_manager` - `system_manager = 9.0` - `sinec_ins < 1.0` - `sinec_ins = 1.0` ## Remediation Upgrade past the affected range: - `lodash 4.17.21` - `jd_edwards_enterpriseone_tools 9.2.6.1` - `sinec_ins 1.0` ## Vendor advisories - **RHSA-2021:2543** · Red Hat · fixed in: Red Hat OpenShift Jaeger 1.20 · released 2021-06-24 · [advisory](https://access.redhat.com/errata/RHSA-2021:2543) - **RHSA-2022:6429** · Red Hat · fixed in: 8Base-RHMTC-1.7 · released 2022-09-13 · [advisory](https://access.redhat.com/errata/RHSA-2022:6429) - **RHSA-2021:2438** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.8 · released 2021-07-27 · [advisory](https://access.redhat.com/errata/RHSA-2021:2438) - **RHSA-2021:3459** · Red Hat · fixed in: Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts · released 2021-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2021:3459) - **RHSA-2021:2179** · Red Hat · fixed in: RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 · released 2021-06-01 · [advisory](https://access.redhat.com/errata/RHSA-2021:2179) - **RHSA-2026:7329** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-04-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:7329) - **Red Hat VEX** · Moderate · affected: OpenShift Service Mesh 2.0, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 1.2, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, Red Hat Quay 3 · no fix planned: Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4, Red Hat Quay 3, OpenShift Service Mesh 2.0, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-23337.json)