p PatchFirst

CVE-2021-23337

CVE-2021-23337 · Command Injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVSS 7.2 · High · EPSS 21.3% · Public exploit · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • lodash

    Versions
    • prior to 4.17.21: Affected

    No fix published

  • node-lodash Debian:12

    Affected ranges
    • ECOSYSTEM: < 4.17.21+dfsg+~cs8.31.173-1

    Update to 4.17.21+dfsg+~cs8.31.173-1

  • node-lodash Debian:13

    Affected ranges
    • ECOSYSTEM: < 4.17.21+dfsg+~cs8.31.173-1

    Update to 4.17.21+dfsg+~cs8.31.173-1

  • node-lodash Debian:14

    Affected ranges
    • ECOSYSTEM: < 4.17.21+dfsg+~cs8.31.173-1

    Update to 4.17.21+dfsg+~cs8.31.173-1

  • lodash npm

    Affected ranges
    • SEMVER: < 4.17.21

    Update to 4.17.21

  • lodash-es npm

    Affected ranges
    • SEMVER: < 4.17.21

    Update to 4.17.21

  • lodash.template npm

    Affected ranges
    • SEMVER: ≤ 4.5.0

    No fix published

  • lodash-template npm

    Affected ranges
    • SEMVER: ≤ 1.0.0

    No fix published

  • lodash-rails RubyGems

    Versions
    • 0.10.0
    • 0.7.0
    • 0.8.1
    • 0.8.2
    • 0.9.0
    • 0.9.1
    • 0.9.2
    • 1.0.0.rc.1
    • 1.0.0.rc.2
    • 1.0.0.rc.3
    • 1.0.1
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 1.2.1
    • 1.3.1
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 2.3.0
    • 2.4.0
    • 2.4.1
    • 3.1.0
    • 3.10.0
    • 3.10.1
    • 3.2.0
    • 3.3.0
    • 3.3.1
    • 3.3.1.1
    • 3.4.0
    • 3.5.0
    • 3.6.0
    • 3.7.0
    • 3.9.3
    • 4.0.0
    • 4.11.2
    • 4.12.0
    • 4.13.1
    • 4.14.1
    • 4.15.0
    • 4.16.1
    • 4.16.3
    • 4.16.4
    • 4.16.6
    • 4.17.10
    • 4.17.11
    • 4.17.14
    • 4.17.15
    • 4.17.2
    • 4.17.4
    • 4.17.5
    • 4.3.0
    • 4.5.1
    • 4.6.1
    Affected ranges
    • ECOSYSTEM: < 4.17.21

    Update to 4.17.21

  • node-lodash Ubuntu:Pro:16.04:LTS

    Versions
    • 2.4.1+dfsg-3
    Affected ranges
    • ECOSYSTEM: < 2.4.1+dfsg-3ubuntu0.1~esm1

    Update to 2.4.1+dfsg-3ubuntu0.1~esm1

  • node-lodash Ubuntu:Pro:18.04:LTS

    Versions
    • 4.17.4+dfsg-1
    Affected ranges
    • ECOSYSTEM: < 4.17.4+dfsg-1ubuntu0.1~esm1

    Update to 4.17.4+dfsg-1ubuntu0.1~esm1

  • node-lodash Ubuntu:Pro:20.04:LTS

    Versions
    • 4.17.11+dfsg-4
    • 4.17.15+dfsg-2
    Affected ranges
    • ECOSYSTEM: < 4.17.15+dfsg-2ubuntu0.1~esm1

    Update to 4.17.15+dfsg-2ubuntu0.1~esm1

Original sources

Check your server →