CVE
CVE-2021-23337
- First Reported
- Oct 18, 2026
- Latest Reported
- Oct 18, 2026
CVE Enrichment
- CVSS
- 7.2 HIGH
- EPSS
- 21.33%
- EPSS Percentile
- 97.60%
- CISA KEV
- Not listed
Description
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- [email protected]
- Published
- 15-Feb-2021 20:15
- Last Modified
- 09-Oct-2026 05:17
- EPSS Date
- 2026-10-24
- CWE
- CWE-94
CVSS Vector
CVSS:3.1 AV:N /
AC:L /
PR:H /
UI:N /
S:U /
C:H /
I:H /
A:H
Affected Products / Versions
- lodash / lodash
Version / affected range: * · before (exclusive) 4.17.21
cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* - oracle / banking_corporate_lending_process_management
Version / affected range: 14.2.0
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2.0:*:*:*:*:*:*:* - oracle / banking_corporate_lending_process_management
Version / affected range: 14.3.0
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3.0:*:*:*:*:*:*:* - oracle / banking_corporate_lending_process_management
Version / affected range: 14.5.0
cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5.0:*:*:*:*:*:*:* - oracle / banking_credit_facilities_process_management
Version / affected range: 14.2.0
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2.0:*:*:*:*:*:*:* - oracle / banking_credit_facilities_process_management
Version / affected range: 14.3.0
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3.0:*:*:*:*:*:*:* - oracle / banking_credit_facilities_process_management
Version / affected range: 14.5.0
cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5.0:*:*:*:*:*:*:* - oracle / banking_extensibility_workbench
Version / affected range: 14.2.0
cpe:2.3:a:oracle:banking_extensibility_workbench:14.2.0:*:*:*:*:*:*:* - oracle / banking_extensibility_workbench
Version / affected range: 14.3.0
cpe:2.3:a:oracle:banking_extensibility_workbench:14.3.0:*:*:*:*:*:*:* - oracle / banking_extensibility_workbench
Version / affected range: 14.5.0
cpe:2.3:a:oracle:banking_extensibility_workbench:14.5.0:*:*:*:*:*:*:* - oracle / banking_supply_chain_finance
Version / affected range: 14.2.0
cpe:2.3:a:oracle:banking_supply_chain_finance:14.2.0:*:*:*:*:*:*:* - oracle / banking_supply_chain_finance
Version / affected range: 14.3.0
cpe:2.3:a:oracle:banking_supply_chain_finance:14.3.0:*:*:*:*:*:*:* - oracle / banking_supply_chain_finance
Version / affected range: 14.5.0
cpe:2.3:a:oracle:banking_supply_chain_finance:14.5.0:*:*:*:*:*:*:* - oracle / banking_trade_finance_process_management
Version / affected range: 14.2.0
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2.0:*:*:*:*:*:*:* - oracle / banking_trade_finance_process_management
Version / affected range: 14.3.0
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3.0:*:*:*:*:*:*:* - oracle / banking_trade_finance_process_management
Version / affected range: 14.5.0
cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5.0:*:*:*:*:*:*:* - oracle / communications_cloud_native_core_binding_support_function
Version / affected range: 1.9.0
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.9.0:*:*:*:*:*:*:* - oracle / communications_cloud_native_core_policy
Version / affected range: 1.11.0
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.11.0:*:*:*:*:*:*:* - oracle / communications_design_studio
Version / affected range: 7.4.2.0.0
cpe:2.3:a:oracle:communications_design_studio:7.4.2.0.0:*:*:*:*:*:*:* - oracle / communications_services_gatekeeper
Version / affected range: 7.0
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* - oracle / communications_session_border_controller
Version / affected range: 8.4
cpe:2.3:a:oracle:communications_session_border_controller:8.4:*:*:*:*:*:*:* - oracle / communications_session_border_controller
Version / affected range: 9.0
cpe:2.3:a:oracle:communications_session_border_controller:9.0:*:*:*:*:*:*:* - oracle / enterprise_communications_broker
Version / affected range: 3.2.0
cpe:2.3:a:oracle:enterprise_communications_broker:3.2.0:*:*:*:*:*:*:* - oracle / enterprise_communications_broker
Version / affected range: 3.3.0
cpe:2.3:a:oracle:enterprise_communications_broker:3.3.0:*:*:*:*:*:*:* - oracle / financial_services_crime_and_compliance_management_studio
Version / affected range: 8.0.8.2.0
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* - oracle / financial_services_crime_and_compliance_management_studio
Version / affected range: 8.0.8.3.0
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* - oracle / health_sciences_data_management_workbench
Version / affected range: 2.5.2.1
cpe:2.3:a:oracle:health_sciences_data_management_workbench:2.5.2.1:*:*:*:*:*:*:* - oracle / health_sciences_data_management_workbench
Version / affected range: 3.0.0.0
cpe:2.3:a:oracle:health_sciences_data_management_workbench:3.0.0.0:*:*:*:*:*:*:* - oracle / jd_edwards_enterpriseone_tools
Version / affected range: * · before (exclusive) 9.2.6.1
cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:* - oracle / peoplesoft_enterprise_peopletools
Version / affected range: 8.58
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* - oracle / peoplesoft_enterprise_peopletools
Version / affected range: 8.59
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 17.12.0 · through (inclusive) 17.12.11
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 18.8.0 · through (inclusive) 18.8.12
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 19.12.0 · through (inclusive) 19.12.11
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_gateway
Version / affected range: * · from (inclusive) 20.12.0 · through (inclusive) 20.12.7
cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: * · from (inclusive) 17.7 · through (inclusive) 17.12
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 18.8
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 19.12
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:* - oracle / primavera_unifier
Version / affected range: 20.12
cpe:2.3:a:oracle:primavera_unifier:20.12:*:*:*:*:*:*:* - oracle / retail_customer_management_and_segmentation_foundation
Version / affected range: 19.0
cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:* - netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* - netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* - netapp / active_iq_unified_manager
Version / affected range: -
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* - netapp / cloud_manager
Version / affected range: -
cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:* - netapp / system_manager
Version / affected range: 9.0
cpe:2.3:a:netapp:system_manager:9.0:*:*:*:*:*:*:* - siemens / sinec_ins
Version / affected range: * · before (exclusive) 1.0
cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* - siemens / sinec_ins
Version / affected range: 1.0
cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* - siemens / sinec_ins
Version / affected range: 1.0
cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*
References
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- CVE-2021-23337 is a command injection in the JavaScript utility library, Lodash. The vulnerability lives in lodash's _.template affecting versions before 4.17.21. lodash inserts a value into the function’s source code Reachable CVEs Aren’t Always Exploitable: How App Context Changes Risk
CVE (1)
Vendors (1)
Products (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.