CVE-2021-23337: lodash vulnerable to Code Injection via `_.template` imports key names

CVE-2021-23337 · Severity: low · CVSS 3.1 · Published 2026-04-01

Lodash is a widely used JavaScript utility library that helps developers manage data and create templates for web applications. A security flaw in its templating engine allows an attacker with high-level access to execute unauthorized commands on the server. This could lead to a complete takeover of the application, theft of sensitive data, or disruption of services.

Technologies: lodash (npm), lodash-es (npm). Vendors: npm.

Quick answers

Is CVE-2021-23337 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-23337 being exploited in the wild.
How severe is CVE-2021-23337?
Low severity, with a CVSS score of 3.1, published 1 April 2026.
Which products and versions are affected?
lodash (npm) SEMVER:introduced=4.0.0,fixed=4.18.0; lodash-es (npm) SEMVER:introduced=4.0.0,fixed=4.18.0; lodash.template (npm) SEMVER:introduced=4.0.0,fixed=4.18.0.
Is there a fix for CVE-2021-23337?
Yes. lodash (npm): upgrade to 4.18.0 or later; lodash-es (npm): upgrade to 4.18.0 or later; lodash.template (npm): upgrade to 4.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-23337 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-23337?
Check whether you run lodash (npm), lodash-es (npm) or lodash.template (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • lodash (npm): upgrade to 4.18.0 or later
    npm install lodash@4.18.0
  • lodash-es (npm): upgrade to 4.18.0 or later
    npm install lodash-es@4.18.0
  • lodash.template (npm): upgrade to 4.18.0 or later
    npm install lodash.template@4.18.0

Technical details

Lodash versions prior to 4.17.21 are vulnerable to Code Injection (CWE-94) and Command Injection (CWE-77) within the `_.template` function. The vulnerability stems from improper validation of the `variable` key name in the options object passed to the template engine. An attacker can provide a malicious string as the `variable` option, which is then concatenated into the generated function body without sufficient sanitization. This allows for the execution of arbitrary JavaScript expressions at template compilation time. While the attack vector is network-based, it typically requires high privileges (PR:H) to influence the template options. The issue is fixed in version 4.17.21.

Affected products

  • lodash lodash < 4.17.21
  • lodash lodash-es < 4.17.21
  • lodash lodash.template <= 4.5.0
  • lodash-rails lodash-rails < 4.17.21

Identifiers

  • CVE-2021-23337
  • GHSA-35jh-r3h4-6jhm
  • GHSA-r5fr-rjxr-66jc

Timeline

  • 2020-11-17: disclosed: Vulnerability disclosed by Marc Hassan
  • 2021-02-15: advisory: NVD and Snyk published advisories
  • 2021-05-06: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.