Command injection in Lodash
Priority MEDIUM 59CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 6 fixed, 6 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.21333 97th percentileScored 2026-11-07
Fix Partial Lodash: 4.17.21lodash (npm): 4.17.21+2 more productsRed Hat: 7 advisoriesRed Hat: 6 fixed, 6 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Lodash | before 4.17.21 | 4.17.21 | Patch available | CNA |
| — | lodash (npm) | before 4.17.21 | 4.17.21 | Patch available | GHSA-35jh-r3h4-6jhm |
| — | lodash-es (npm) | before 4.17.21 | 4.17.21 | Patch available | GHSA-35jh-r3h4-6jhm |
| — | lodash.template (npm) | up to 4.5.0 | — | No fix listed | GHSA-35jh-r3h4-6jhm |
| — | lodash-template (npm) | up to 1.0.0 | — | No fix listed | GHSA-35jh-r3h4-6jhm |
| — | lodash-rails (RubyGems) | before 4.17.21 | 4.17.21 | Patch available | GHSA-35jh-r3h4-6jhm |
- Lodash Vendor— Affected before 4.17.21 Fixed in 4.17.21 Patch available CNA
- lodash (npm) Vendor— Affected before 4.17.21 Fixed in 4.17.21 Patch available GHSA-35jh-r3h4-6jhm
- lodash-es (npm) Vendor— Affected before 4.17.21 Fixed in 4.17.21 Patch available GHSA-35jh-r3h4-6jhm
- lodash.template (npm) Vendor— Affected up to 4.5.0 Fixed in — No fix listed GHSA-35jh-r3h4-6jhm
- lodash-template (npm) Vendor— Affected up to 1.0.0 Fixed in — No fix listed GHSA-35jh-r3h4-6jhm
- lodash-rails (RubyGems) Vendor— Affected before 4.17.21 Fixed in 4.17.21 Patch available GHSA-35jh-r3h4-6jhm
CPE configurations NVD · 45
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* | before 4.17.21 | Vulnerable | lodash |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
- cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* Versions before 4.17.21 Vulnerable ·lodash
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
Show 35 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:* | 14.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* | 14.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:* | 14.5.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.9.0:*:*:*:*:*:*:* | 1.9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:* | 1.11.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_design_studio:7.4.2.0.0:*:*:*:*:*:*:* | 7.4.2.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* | 8.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* | 3.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:* | 3.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* | 8.0.8.2.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* | 8.0.8.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:* | 2.5.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:* | 3.0.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* | before 9.2.6.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | 8.59 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* | 17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* | 17.7 – 17.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* | 18.8 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* | 19.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* | 20.12 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* | 19.0 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:system_manager:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | NetApp |
| cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* | before 1.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* | 1.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* | 1.0 sp1 | Vulnerable | Siemens |
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:* Versions 14.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* Versions 14.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:* Versions 14.5.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.9.0:*:*:*:*:*:*:* Versions 1.9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_design_studio:7.4.2.0.0:*:*:*:*:*:*:* Versions 7.4.2.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* Versions 8.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:* Versions 3.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:* Versions 2.5.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:* Versions 3.0.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* Versions before 9.2.6.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* Versions 17.12.0 – 17.12.11; 18.8.0 – 18.8.12; 19.12.0 – 19.12.11; 20.12.0 – 20.12.7 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* Versions 17.7 – 17.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* Versions 18.8 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* Versions 19.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* Versions 20.12 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* Versions 19.0 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:system_manager:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·NetApp
- cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* Versions before 1.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* Versions 1.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* Versions 1.0 sp1 Vulnerable ·Siemens
Remediation
- Fix · CNA Lodash Fixed in 4.17.21
- Fix · GHSA-35jh-r3h4-6jhm lodash (npm) Fixed in 4.17.21 Advisory →
- Fix · GHSA-35jh-r3h4-6jhm lodash-es (npm) Fixed in 4.17.21 Advisory →
- Fix · GHSA-35jh-r3h4-6jhm lodash-rails (RubyGems) Fixed in 4.17.21 Advisory →
Red Hat 7 advisories
- RHSA-2026:7329 Released 2026-04-09 · Red Hat rating ImportantA Subscription Management tool for finding and reporting Red Hat product usage
- Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
- RHSA-2022:6429 Released 2022-09-13 · Red Hat rating ImportantMigration Toolkit for Containers (MTC) 1.7.4 security and bug fix update
- 8Base-RHMTC-1.7 rhmtc/openshift-migration-controller-rhel8, rhmtc/openshift-migration-must-gather-rhel8, rhmtc/openshift-migration-registry-rhel8 +7
- RHSA-2021:3459 Released 2021-09-08 · Red Hat rating ModerateRed Hat Virtualization Host security and bug fix update [ovirt-4.4.8]
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts cockpit-ovirt-0.15.1-2.el8ev, cockpit-ovirt-dashboard-0.15.1-2.el8ev
Show 4 more Red Hat advisories
- RHSA-2021:2438 Released 2021-07-27 · Red Hat rating ModerateOpenShift Container Platform 4.8.2 bug fix and security update
- Red Hat OpenShift Container Platform 4.8 openshift4/driver-toolkit-rhel8, openshift4/egress-router-cni-rhel8, openshift4/network-tools-rhel8 +47
- RHSA-2021:2543 Released 2021-06-24 · Red Hat rating ModerateRed Hat OpenShift Jaeger 1.20.4 security update
- Red Hat OpenShift Jaeger 1.20 distributed-tracing/jaeger-agent-rhel8, distributed-tracing/jaeger-all-in-one-rhel8, distributed-tracing/jaeger-collector-rhel8 +5
- RHSA-2021:2179 Released 2021-06-01 · Red Hat rating ModerateRHV Manager security update (ovirt-engine) [ovirt-4.4.6]
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-ui-extensions-1.2.6-1.el8ev, ovirt-web-ui-1.6.9-1.el8ev
- RHSA-2021:1168 Released 2021-04-13 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.2.2 security and bug fix update
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Service Mesh 2.0 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ansible Automation Platform 1.2 | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| 8Base-RHMTC-1.7 | Fixed | RHSA-2022:6429 |
| RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 | Fixed | RHSA-2021:2179 |
| Red Hat Discovery 2 | Fixed | RHSA-2026:7329 |
| Red Hat OpenShift Container Platform 4.8 | Fixed | RHSA-2021:2438 |
| Red Hat OpenShift Jaeger 1.20 | Fixed | RHSA-2021:2543 |
| Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts | Fixed | RHSA-2021:3459 |
Not affected: 10 products
- 8Base-RHMTC-1.7
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Decision Manager 7
- Red Hat Discovery 2
- Red Hat OpenShift Container Platform 4.8
- Red Hat OpenShift Jaeger 1.20
- Red Hat Process Automation 7
- Red Hat Virtualization 4 Hypervisor for RHEL 8
- Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23337
- 2026-10-03 Alias added: GHSA-35jh-r3h4-6jhm
- 2026-10-08 CISA SSVC decision points changed
References
Patch 5
Advisory 2
Other 6
- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851
- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
- https://security.netapp.com/advisory/ntap-20210312-0006
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml
- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851
- https://github.com/lodash/lodash
Sources
- CVE-2021-23337 · CVE Program
- CVE-2021-23337 · NVD
- FIRST EPSS
- GHSA-35jh-r3h4-6jhm · GitHub Advisory Database · CC BY 4.0
- CVE-2021-23337 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences