Log in Start free

Vulnerability · Published Feb 15, 2021 · Assigned by snyk

CVE-2021-23337Command Injection

High 7.2

In plain English

A high-severity security flaw in Lodash. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 21.3% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)21.3%top 2.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling2Nuclei, Public PoC

Official description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-lodash4.17.21+dfsg+~cs8.31.173-1DEBIAN-CVE-2021-23337
Debian:13node-lodash4.17.21+dfsg+~cs8.31.173-1DEBIAN-CVE-2021-23337
Debian:14node-lodash4.17.21+dfsg+~cs8.31.173-1DEBIAN-CVE-2021-23337
RubyGemslodash-rails4.17.21GHSA-35jh-r3h4-6jhm
Ubuntu:25.10node-lodash4.17.21+dfsg+~cs8.31.198.20210220-9ubuntu0.25.10.1USN-8411-1
npmlodash4.17.21GHSA-35jh-r3h4-6jhm
npmlodash-es4.17.21GHSA-35jh-r3h4-6jhm
npmlodash-templateno fix listedGHSA-35jh-r3h4-6jhm
npmlodash.templateno fix listedGHSA-35jh-r3h4-6jhm

Affected products (as reported)

VendorProductVersions
n/a Lodash prior to 4.17.21

References