--- id: CVE-2021-23337 title: >- Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. summary: >- Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. severity: high cvss: 7.2 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-94 vendor: lodash product: lodash affected: - lodash < 4.17.21 - banking_corporate_lending_process_management = 14.2.0 - banking_corporate_lending_process_management = 14.3.0 - banking_corporate_lending_process_management = 14.5.0 - banking_credit_facilities_process_management = 14.2.0 - banking_credit_facilities_process_management = 14.3.0 - banking_credit_facilities_process_management = 14.5.0 - banking_extensibility_workbench = 14.2.0 - banking_extensibility_workbench = 14.3.0 - banking_extensibility_workbench = 14.5.0 - banking_supply_chain_finance = 14.2.0 - banking_supply_chain_finance = 14.3.0 - banking_supply_chain_finance = 14.5.0 - banking_trade_finance_process_management = 14.2.0 - banking_trade_finance_process_management = 14.3.0 - banking_trade_finance_process_management = 14.5.0 - communications_cloud_native_core_binding_support_function = 1.9.0 - communications_cloud_native_core_policy = 1.11.0 - communications_design_studio = 7.4.2.0.0 - communications_services_gatekeeper = 7.0 - communications_session_border_controller = 8.4 - communications_session_border_controller = 9.0 - enterprise_communications_broker = 3.2.0 - enterprise_communications_broker = 3.3.0 - financial_services_crime_and_compliance_management_studio = 8.0.8.2.0 - financial_services_crime_and_compliance_management_studio = 8.0.8.3.0 - health_sciences_data_management_workbench = 2.5.2.1 - health_sciences_data_management_workbench = 3.0.0.0 - jd_edwards_enterpriseone_tools < 9.2.6.1 - peoplesoft_enterprise_peopletools = 8.58 - peoplesoft_enterprise_peopletools = 8.59 - 'primavera_gateway >= 17.12.0, <= 17.12.11' - 'primavera_gateway >= 18.8.0, <= 18.8.12' - 'primavera_gateway >= 19.12.0, <= 19.12.11' - 'primavera_gateway >= 20.12.0, <= 20.12.7' - 'primavera_unifier >= 17.7, <= 17.12' - primavera_unifier = 18.8 - primavera_unifier = 19.12 - primavera_unifier = 20.12 - retail_customer_management_and_segmentation_foundation = 19.0 - active_iq_unified_manager - cloud_manager - system_manager = 9.0 - sinec_ins < 1.0 - sinec_ins = 1.0 patched: - lodash 4.17.21 - jd_edwards_enterpriseone_tools 9.2.6.1 - sinec_ins 1.0 published: '2021-02-15' updated: '2026-10-08' sourceUpdated: '2026-10-08T22:17:07.363' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-23337' references: - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf' label: report@snyk.io - url: >- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851 label: report@snyk.io - url: 'https://security.netapp.com/advisory/ntap-20210312-0006/' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929' label: report@snyk.io - url: 'https://snyk.io/vuln/SNYK-JS-LODASH-1040724' label: report@snyk.io - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: report@snyk.io - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: report@snyk.io - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: report@snyk.io - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: report@snyk.io - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851 label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20210312-0006/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://snyk.io/vuln/SNYK-JS-LODASH-1040724' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujul2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuoct2021.html' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd - exploit-available epss: 0.21333 epssPercentile: 0.97549 exploits: github: 1 githubRepos: - 'https://github.com/khayashi4337/lodash.template-fixed' nuclei: - CVE-2021-23337 checkedAt: '2026-10-08T23:17:21.749Z' exploitAvailable: true ingestedAt: '2026-10-08T23:16:47.314Z' --- ## Overview Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. ## Affected - `lodash < 4.17.21` - `banking_corporate_lending_process_management = 14.2.0` - `banking_corporate_lending_process_management = 14.3.0` - `banking_corporate_lending_process_management = 14.5.0` - `banking_credit_facilities_process_management = 14.2.0` - `banking_credit_facilities_process_management = 14.3.0` - `banking_credit_facilities_process_management = 14.5.0` - `banking_extensibility_workbench = 14.2.0` - `banking_extensibility_workbench = 14.3.0` - `banking_extensibility_workbench = 14.5.0` - `banking_supply_chain_finance = 14.2.0` - `banking_supply_chain_finance = 14.3.0` - `banking_supply_chain_finance = 14.5.0` - `banking_trade_finance_process_management = 14.2.0` - `banking_trade_finance_process_management = 14.3.0` - `banking_trade_finance_process_management = 14.5.0` - `communications_cloud_native_core_binding_support_function = 1.9.0` - `communications_cloud_native_core_policy = 1.11.0` - `communications_design_studio = 7.4.2.0.0` - `communications_services_gatekeeper = 7.0` - `communications_session_border_controller = 8.4` - `communications_session_border_controller = 9.0` - `enterprise_communications_broker = 3.2.0` - `enterprise_communications_broker = 3.3.0` - `financial_services_crime_and_compliance_management_studio = 8.0.8.2.0` - `financial_services_crime_and_compliance_management_studio = 8.0.8.3.0` - `health_sciences_data_management_workbench = 2.5.2.1` - `health_sciences_data_management_workbench = 3.0.0.0` - `jd_edwards_enterpriseone_tools < 9.2.6.1` - `peoplesoft_enterprise_peopletools = 8.58` - `peoplesoft_enterprise_peopletools = 8.59` - `primavera_gateway >= 17.12.0, <= 17.12.11` - `primavera_gateway >= 18.8.0, <= 18.8.12` - `primavera_gateway >= 19.12.0, <= 19.12.11` - `primavera_gateway >= 20.12.0, <= 20.12.7` - `primavera_unifier >= 17.7, <= 17.12` - `primavera_unifier = 18.8` - `primavera_unifier = 19.12` - `primavera_unifier = 20.12` - `retail_customer_management_and_segmentation_foundation = 19.0` - `active_iq_unified_manager` - `cloud_manager` - `system_manager = 9.0` - `sinec_ins < 1.0` - `sinec_ins = 1.0` ## Remediation Upgrade past the affected range: - `lodash 4.17.21` - `jd_edwards_enterpriseone_tools 9.2.6.1` - `sinec_ins 1.0`