Reachable CVEs Aren’t Always Exploitable: How App Context Changes Risk

Summary

An explainer distinguishes code reachability from exploitability, showing how attacker-controlled input, configuration, privileges and deployment affect CVE risk. Lodash examples illustrate different outcomes; Aikido also describes its exploitability-analysis product.

Key points

• Reachability analysis checks whether code can call a vulnerable package or function; it does not establish that an attacker can exploit the flaw.
• Exploitability depends on factors such as attacker-controlled input, required configuration, privileges, user interaction, deployment context and existing mitigations.
• For CVE-2021-23337 in Lodash, an app that never calls _.template may be cleared by reachability analysis, while an app using developer-controlled template options may be reachable but less exploitable.
• An app that passes request data into the vulnerable template option may remain high priority because attacker input can reach it.
• The article says Lodash's fix for CVE-2021-23337 missed options.imports key names, which feed the same Function() constructor; that path later became CVE-2026-4800, fixed in Lodash 4.18.0.
• The article says exploitability verdicts reflect current code and deployment, and may change with new call sites, input paths, configuration or base images.
• Aikido says its CVE Exploitability Analysis reviews repository and container context and can recommend triage actions with written reasoning for reviewer approval.

CVE

Vendors

Products