Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2021-23337 — Code Injection in Lodash

CWE-94 — Code InjectionCWE-78 — OS Command InjectionCWE-77 — Command Injection15 documents10 sources
Severity
7.2HIGHNVD
EPSS
4.3%
top 11.09%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
24
LodashLodash Lodash-amdLodash Lodash-es+21 more
Timeline
PublishedFeb 15
Latest updateApr 1

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages27 packages

▶CVEListV5lodash/lodash.template4.0.0 — 4.18.0
▶CVEListV5lodash/lodash4.0.0 — 4.18.0+1
▶NVDlodash/lodash< 4.17.21
▶npmlodash/lodash< 4.17.21

Patches

Patch: cert-portal.siemens.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

5
GHSA
lodash vulnerable to Code Injection via `_.template` imports key names↗2026-04-01
▶
OSV
Command Injection in lodash↗2021-05-06
▶
GHSA
Command Injection in lodash↗2021-05-06
▶
CVEList
Command Injection↗2021-02-15
▶
OSV
CVE-2021-23337: Lodash versions prior to 4↗2021-02-15
▶

💥Exploits & PoCs

1
Nuclei
Lodash Template - Server-Side Template Injection (RCE)
▶

📋Vendor Advisories

6
Red Hat
lodash: lodash: Arbitrary code execution via untrusted input in template imports↗2026-03-31
▶
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Studio (Lodash) — CVE-2021-23337↗2022-07-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Binding Support Function (Lodash) — CVE-2021-23337↗2022-01-15
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Lodash) — CVE-2021-23337↗2021-10-15
▶
Red Hat
nodejs-lodash: command injection via template↗2021-02-15
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-4800 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

1
Bugzilla
CVE-2026-4800 lodash: lodash: Arbitrary code execution via untrusted input in template imports↗2026-03-31
▶
CVE-2021-23337 — Code Injection in Lodash | cvebase