CVE-2021-23337

7.2

HIGHCVSS v3

Published

February 15, 2021

CVSS v2

6.5 MEDIUM

Affected

14 projects

Assigned by

[email protected]

Severity scale

010

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

lodash

NPMLodash modular utilities.

< 4.17.21, >= 4.0.0, < 4.18.0NVD

lodash-es

NPMLodash exported as ES modules.

< 4.17.21, >= 4.0.0, < 4.18.0OSV

lodash.template

NPM

More on this CVE

NVD↗GitHub Advisory↗

The Lodash method `_.template` exported as a module.

<= 4.5.0, <= 1.0.0, >= 4.0.0, < 4.18.0OSV

@types/lodash

NPMTypeScript definitions for lodash

< 4.17.21, >= 4.0.0, < 4.18.0NVD

lodash-amd

NPMLodash exported as AMD modules.

>= 4.0.0, < 4.18.0OSV

@snyk/lodash

NPM[Site](https://lodash.com/) | [Docs](https://lodash.com/docs) | [FP Guide](https://github.com/lodash/lodash/wiki/FP-Guide) | [Contributing](https://github.com/lodash/lodash/blob/master/.github/CONTRIBUTING.md) | [Wiki](https://github.com/lodash/lodash/wik

< 4.17.21, >= 4.0.0, < 4.18.0NVD

FGRibreau/lodash

GitHub:trumpet: My own version of lodash with extra mixins

< 4.17.21, >= 4.0.0, < 4.18.0NVD

@sailshq/lodash

NPMA fork of Lodash 3.10.x with ongoing maintenance from the Sails core team.

< 4.17.21, >= 4.0.0, < 4.18.0NVD

lodash-template

NPM_.template without full lodash source.

<= 4.5.0, <= 1.0.0, >= 4.0.0, < 4.18.0OSV

sailshq/lodash

GitHubA fork of Lodash 3.10.x with ongoing maintenance from the Sails core team. **There will be no changes or additions to existing usage. (That means no new features.)**

< 4.17.21, >= 4.0.0, < 4.18.0NVD

treelinehq/lodash

GitHub

< 4.17.21, >= 4.0.0, < 4.18.0NVD

lodash/lodash

GitHubA modern JavaScript utility library delivering modularity, performance, & extras.

< 4.17.21, >= 4.0.0, < 4.18.0NVD