CVE-2021-23337: Command Injection in lodash
Summary
Your scan reports lodash 4.17.20. Fixed in 4.17.21.
CVE-2021-23337: Command Injection in lodash. Affects lodash versions < 4.17.21. Fixed in 4.17.21. How to fix ↓
Also tracked for
- node-lodash · Debian:11
The same CVE-2021-23337 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
lodash is a popular JavaScript utility library that provides helpful functions for manipulating and working with arrays, objects, and other data types. It is widely used in many JavaScript projects and frameworks. However, versions prior to 4.17.21 of lodash are vulnerable to a Command Injection vulnerability. This vulnerability specifically affects the template function in lodash, allowing an attacker to execute arbitrary commands through specially crafted templates.
Vulnerability Detail
The Command Injection vulnerability in lodash arises from improper input validation and sanitization in the template function. By injecting malicious commands into a template, an attacker can execute arbitrary code on the target system. This can lead to various security risks, including remote code execution, data exfiltration, and unauthorized access to sensitive information. The vulnerability has a CVSS score of 7.2, indicating a high severity level.
How To Fix
Latest published version: 4.18.1 as of 22 Oct 2026
npm install lodash@4.18.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.17.21
This is the first release that contains the fix.
npm install lodash@4.17.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of lodash is not immediately feasible, a temporary workaround is to avoid using the template function or to carefully validate and sanitize user input before passing it to the template function. By thoroughly validating and sanitizing input, developers can mitigate the risk of command injection attacks.
Conclusion
In conclusion, the Command Injection vulnerability in lodash can have serious security implications. It is crucial for developers to upgrade to the latest version of lodash (4.17.21 or later) and implement proper input validation and sanitization to mitigate the risk of command injection attacks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for lodash →
FAQ
lodash is a JavaScript utility library that provides helpful functions for manipulating and working with arrays, objects, and other data types. It is widely used in many JavaScript projects and frameworks.
The Command Injection vulnerability in lodash can allow an attacker to execute arbitrary commands on the target system. This can lead to various security risks, including remote code execution, data exfiltration, and unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade lodash to version 4.17.21 or later. Additionally, developers should sanitize user input and validate template variables to prevent potential command injection attacks.
If upgrading to the latest version of lodash is not immediately feasible, a temporary workaround is to avoid using the template function or to carefully validate and sanitize user input before passing it to the template function.
The CVSS score of this vulnerability is 7.2, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for lodash.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.