CVE-2021-23337 — Lodash Vulnerability Details

What is CVE-2021-23337?

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

The record classifies CVE-2021-23337 under weakness class CWE-94. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs high-privilege credentials, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 2096 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 7.2 — HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C
EPSS (FIRST): 21.3% probability of exploitation in the next 30 days, higher than 97.5% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 10/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2021-02-15

Is CVE-2021-23337 being exploited?

Weaponised exploit code for CVE-2021-23337 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (http/cves/2021/CVE-2021-23337.yaml). It currently carries a trending score of 39 in the Threadlinqs vulnerability feed.

khayashi4337/lodash.template-fixed (github)
trickest/cve (trickest)

Affected products and versions

(vendor unspecified): Lodash

Affected software packages:

npm:lodash — patched in 4.17.21
npm:lodash-es — patched in 4.17.21
npm:lodash.template
npm:lodash-template
rubygems:lodash-rails — patched in 4.17.21

How to fix CVE-2021-23337

The record marks a vendor fix as available for CVE-2021-23337. Fixed versions are recorded for 3 packages: npm:lodash 4.17.21, npm:lodash-es 4.17.21, rubygems:lodash-rails 4.17.21. Patch reference: https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

Threat activity tracking CVE-2021-23337

1 tracked threat in the Threadlinqs corpus references CVE-2021-23337, either in the campaign’s CVE list or as an indicator on the campaign record.

CVE-2026-4800: Lodash `_.template` Arbitrary Code Injection — Broken 4.18.0 Patch Exposes Supply-Chain Patch-Pinning Risk — HIGH · 2026-08-26

Sources

Enriched from CVE.org, NVD, FIRST EPSS, GitHub Security Advisories, public proof-of-concept repositories, ProjectDiscovery Nuclei. This product uses the NVD API but is not endorsed or certified by the NVD.

Vendor advisory and patch

Other references

Showing 7 of 13 recorded references.