{"id":"CVE-2021-23337","title":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","summary":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-94"],"vendor":"lodash","product":"lodash","affected":["lodash < 4.17.21","banking_corporate_lending_process_management = 14.2.0","banking_corporate_lending_process_management = 14.3.0","banking_corporate_lending_process_management = 14.5.0","banking_credit_facilities_process_management = 14.2.0","banking_credit_facilities_process_management = 14.3.0","banking_credit_facilities_process_management = 14.5.0","banking_extensibility_workbench = 14.2.0","banking_extensibility_workbench = 14.3.0","banking_extensibility_workbench = 14.5.0","banking_supply_chain_finance = 14.2.0","banking_supply_chain_finance = 14.3.0","banking_supply_chain_finance = 14.5.0","banking_trade_finance_process_management = 14.2.0","banking_trade_finance_process_management = 14.3.0","banking_trade_finance_process_management = 14.5.0","communications_cloud_native_core_binding_support_function = 1.9.0","communications_cloud_native_core_policy = 1.11.0","communications_design_studio = 7.4.2.0.0","communications_services_gatekeeper = 7.0","communications_session_border_controller = 8.4","communications_session_border_controller = 9.0","enterprise_communications_broker = 3.2.0","enterprise_communications_broker = 3.3.0","financial_services_crime_and_compliance_management_studio = 8.0.8.2.0","financial_services_crime_and_compliance_management_studio = 8.0.8.3.0","health_sciences_data_management_workbench = 2.5.2.1","health_sciences_data_management_workbench = 3.0.0.0","jd_edwards_enterpriseone_tools < 9.2.6.1","peoplesoft_enterprise_peopletools = 8.58","peoplesoft_enterprise_peopletools = 8.59","primavera_gateway >= 17.12.0, <= 17.12.11","primavera_gateway >= 18.8.0, <= 18.8.12","primavera_gateway >= 19.12.0, <= 19.12.11","primavera_gateway >= 20.12.0, <= 20.12.7","primavera_unifier >= 17.7, <= 17.12","primavera_unifier = 18.8","primavera_unifier = 19.12","primavera_unifier = 20.12","retail_customer_management_and_segmentation_foundation = 19.0","active_iq_unified_manager","cloud_manager","system_manager = 9.0","sinec_ins < 1.0","sinec_ins = 1.0"],"patched":["lodash 4.17.21","jd_edwards_enterpriseone_tools 9.2.6.1","sinec_ins 1.0"],"published":"2021-02-15","updated":"2026-10-08","sourceUpdated":"2026-10-08T22:17:07.363","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","label":"report@snyk.io"},{"url":"https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","label":"report@snyk.io"},{"url":"https://security.netapp.com/advisory/ntap-20210312-0006/","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","label":"report@snyk.io"},{"url":"https://snyk.io/vuln/SNYK-JS-LODASH-1040724","label":"report@snyk.io"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"report@snyk.io"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"report@snyk.io"},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20210312-0006/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://snyk.io/vuln/SNYK-JS-LODASH-1040724","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","exploit-available"],"epss":0.21333,"epssPercentile":0.97549,"exploits":{"github":1,"githubRepos":["https://github.com/khayashi4337/lodash.template-fixed"],"nuclei":["CVE-2021-23337"],"checkedAt":"2026-10-08T23:17:21.749Z"},"exploitAvailable":true,"ingestedAt":"2026-10-08T23:16:47.314Z","slug":"CVE-2021-23337","body":"## Overview\n\nLodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.\n\n## Affected\n\n- `lodash < 4.17.21`\n- `banking_corporate_lending_process_management = 14.2.0`\n- `banking_corporate_lending_process_management = 14.3.0`\n- `banking_corporate_lending_process_management = 14.5.0`\n- `banking_credit_facilities_process_management = 14.2.0`\n- `banking_credit_facilities_process_management = 14.3.0`\n- `banking_credit_facilities_process_management = 14.5.0`\n- `banking_extensibility_workbench = 14.2.0`\n- `banking_extensibility_workbench = 14.3.0`\n- `banking_extensibility_workbench = 14.5.0`\n- `banking_supply_chain_finance = 14.2.0`\n- `banking_supply_chain_finance = 14.3.0`\n- `banking_supply_chain_finance = 14.5.0`\n- `banking_trade_finance_process_management = 14.2.0`\n- `banking_trade_finance_process_management = 14.3.0`\n- `banking_trade_finance_process_management = 14.5.0`\n- `communications_cloud_native_core_binding_support_function = 1.9.0`\n- `communications_cloud_native_core_policy = 1.11.0`\n- `communications_design_studio = 7.4.2.0.0`\n- `communications_services_gatekeeper = 7.0`\n- `communications_session_border_controller = 8.4`\n- `communications_session_border_controller = 9.0`\n- `enterprise_communications_broker = 3.2.0`\n- `enterprise_communications_broker = 3.3.0`\n- `financial_services_crime_and_compliance_management_studio = 8.0.8.2.0`\n- `financial_services_crime_and_compliance_management_studio = 8.0.8.3.0`\n- `health_sciences_data_management_workbench = 2.5.2.1`\n- `health_sciences_data_management_workbench = 3.0.0.0`\n- `jd_edwards_enterpriseone_tools < 9.2.6.1`\n- `peoplesoft_enterprise_peopletools = 8.58`\n- `peoplesoft_enterprise_peopletools = 8.59`\n- `primavera_gateway >= 17.12.0, <= 17.12.11`\n- `primavera_gateway >= 18.8.0, <= 18.8.12`\n- `primavera_gateway >= 19.12.0, <= 19.12.11`\n- `primavera_gateway >= 20.12.0, <= 20.12.7`\n- `primavera_unifier >= 17.7, <= 17.12`\n- `primavera_unifier = 18.8`\n- `primavera_unifier = 19.12`\n- `primavera_unifier = 20.12`\n- `retail_customer_management_and_segmentation_foundation = 19.0`\n- `active_iq_unified_manager`\n- `cloud_manager`\n- `system_manager = 9.0`\n- `sinec_ins < 1.0`\n- `sinec_ins = 1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `lodash 4.17.21`\n- `jd_edwards_enterpriseone_tools 9.2.6.1`\n- `sinec_ins 1.0`","depth":"midnight","depthScore":56,"depthScoreParts":{"impact":39.6,"likelihood":4.3,"exploitation":12,"ransomware":0},"changes":[]}