{"id":"GHSA-35jh-r3h4-6jhm","revision":"1b52d2f078454f8d9a7aadc719147f6e","records":[{"revision":"1b52d2f078454f8d9a7aadc719147f6e","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-35jh-r3h4-6jhm","aliases":["CVE-2021-23337"],"title":"Command Injection in lodash","description":"`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","state":0,"publishedAt":"2021-05-06T16:05:51+00:00","modifiedAt":"2026-10-17T02:55:38.0858139+00:00","affected":[{"ecosystem":"npm","name":"lodash","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.17.21"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash-es","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.17.21"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash.template","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"4.5.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"lodash-template","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.0.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"RubyGems","name":"lodash-rails","ranges":[{"type":"ECOSYSTEM","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.17.21"}]}],"versions":["0.10.0","0.7.0","0.8.1","0.8.2","0.9.0","0.9.1","0.9.2","1.0.0.rc.1","1.0.0.rc.2","1.0.0.rc.3","1.0.1","1.1.0","1.1.1","1.2.0","1.2.1","1.3.1","2.0.0","2.1.0","2.2.0","2.2.1","2.3.0","2.4.0","2.4.1","3.1.0","3.10.0","3.10.1","3.2.0","3.3.0","3.3.1","3.3.1.1","3.4.0","3.5.0","3.6.0","3.7.0","3.9.3","4.0.0","4.11.2","4.12.0","4.13.1","4.14.1","4.15.0","4.16.1","4.16.3","4.16.4","4.16.6","4.17.10","4.17.11","4.17.14","4.17.15","4.17.2","4.17.4","4.17.5","4.3.0","4.5.1","4.6.1"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://github.com/lodash/lodash","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"],"sourceUrl":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-35jh-r3h4-6jhm","identifiers":["GHSA-35jh-r3h4-6jhm","CVE-2021-23337"]},"retained":false,"historicalAffected":[]}],"coverage":[]}