CVE-2021-23337

published 2026-03-31

CVE-2021-23337: The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both…

Priority P2 63 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

EXPLOIT

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time. Additionally, _.template uses assignInWith to merge imports, which enumerates inherited properties via for..in, so if Object.prototype has been polluted by another vector the polluted keys are copied into the imports object and passed to Function(). The issue is fixed in 4.18.1 for lodash, lodash-es, lodash-amd, and lodash.template. As a workaround, do not pass untrusted input as key names in options.imports; use only developer-controlled, static key names.

Affected

61 ranges · showing 25

Vendor	Product	Version range	Fixed in
debian	node-lodash	< node-lodash 4.17.21+dfsg+~cs8.31.173-1 (bookworm)	node-lodash 4.17.21+dfsg+~cs8.31.173-1 (bookworm)
debian	node-lodash	< node-lodash 4.18.1+dfsg-1 (forky)	node-lodash 4.18.1+dfsg-1 (forky)
lodash	lodash	< 4.17.21	4.17.21
lodash	lodash	>= 0 < 4.17.21	4.17.21
lodash	lodash	>= 4.0.0 < 4.18.1	4.18.1
lodash	lodash	>= 4.0.0 < 4.18.0	4.18.0
lodash	lodash	>= 4.0.0 < 4.18.0	4.18.0
lodash	lodash-amd	>= 4.0.0 < 4.18.1	4.18.1
lodash	lodash-amd	>= 4.0.0 < 4.18.0	4.18.0
lodash	lodash-es	>= 0 < 4.17.21	4.17.21
lodash	lodash-es	>= 4.0.0 < 4.18.1	4.18.1
lodash	lodash-es	>= 4.0.0 < 4.18.0	4.18.0
lodash	lodash-es	>= 4.0.0 < 4.18.0	4.18.0
lodash	lodash.template	0 – 4.5.0	—
lodash	lodash.template	>= 4.0.0 < 4.18.1	4.18.1
lodash	lodash.template	>= 4.0.0 < 4.18.0	4.18.0
lodash	lodash.template	>= 4.0.0 < 4.18.0	4.18.0
netapp	system_manager	—	—
oracle	banking_corporate_lending_process_management	—	—
oracle	banking_corporate_lending_process_management	—	—
oracle	banking_corporate_lending_process_management	—	—
oracle	banking_credit_facilities_process_management	—	—
oracle	banking_credit_facilities_process_management	—	—
oracle	banking_credit_facilities_process_management	—	—
oracle	banking_extensibility_workbench	—	—

Detection & IOCs extracted from sources · hover to see the quote

url https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c

command POST /template HTTP/1.1 Content-Type: application/json {"template":"","variable":") { return String({{randA}}*{{randB}}) }; with(obj","data":{"name":"test"}}

command GET /render?tpl=hello&variable=)%7Breturn+String({{randA}}*{{randB}})%7D%3Bwith(obj HTTP/1.1

path /template

path /render

• → Exploit payload injects a closing brace and return statement into the `variable` option of _.template, breaking out of the generated function wrapper and executing arbitrary JS at compile time. Look for `variable` parameter values containing `) {` or `}; with(obj` patterns in HTTP request bodies or query strings.
• → URL-encoded variant of the same injection targets the `variable` query parameter: look for `variable=)%7B` or `%7D%3Bwith(obj` in GET requests to template-rendering endpoints.
• → The vulnerability also applies to untrusted `options.imports` key names passed to _.template; both paths flow into the same Function() constructor sink. Monitor for dynamic/untrusted key names in imports objects. ↗
• → Prototype pollution can amplify this CVE: _.template uses assignInWith to merge imports via for..in, so polluted Object.prototype keys are copied into the imports object and passed to Function(). Detect concurrent prototype pollution attempts alongside lodash template calls. ↗
• → Use Shodan/FOFA fingerprinting queries to identify exposed lodash-powered endpoints as attack surface: shodan `http.component:"lodash"`, FOFA `body="lodash"`.
• → The Nuclei template targets POST /template with Content-Type: application/json and GET /render with a `variable` query parameter. Alert on requests to these paths where the `variable` field contains JS syntax characters such as `)`, `{`, `}`, `return`, or `with(`.

• · The fix for CVE-2021-23337 validated the `variable` option but NOT `options.imports` key names; both reach the same Function() sink. Patching to 4.17.21 addresses the `variable` vector but the imports key-name vector requires the additional fix in 4.18.0. ↗
• · Red Hat notes that several affected packages (OpenShift ServiceMesh, RHOSJ) are behind OpenShift OAuth authentication, reducing exploitability to authenticated users only. ↗
• · Red Hat Virtualization cockpit-ovirt and Red Hat Quay (via restangular) depend on lodash but do NOT use the vulnerable template function, so they are not exploitable via this CVE. ↗

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

ghsa 7.2 HIGH

osv 7.2 HIGH

vendor_debian 7.2 HIGH

vendor_oracle 7.2 HIGH

vendor_redhat 7.2 HIGH

vendor_ubuntu 5.3 MEDIUM

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-94 CWE-78 CWE-77