Junglewise Threat Intelligence

CVE-2021-23337: lodash vulnerable to Code Injection via `_.template` imports key names

CVE-2021-23337 · Severity: low · CVSS 3.1 · Published 2026-04-01

Technologies: lodash (npm), lodash-es (npm), Lodash-Rails. Vendors: npm, Lodash.

Executive brief

Lodash is a widely used JavaScript utility library that helps developers manage data and create templates for web applications. A security flaw in its templating engine allows an attacker with high-level access to execute unauthorized commands on the server. This could lead to a complete takeover of the application, theft of sensitive data, or disruption of services.

Technical details

Lodash versions prior to 4.17.21 are vulnerable to Code Injection (CWE-94) and Command Injection (CWE-77) within the `_.template` function. The vulnerability stems from improper validation of the `variable` key name in the options object passed to the template engine. An attacker can provide a malicious string as the `variable` option, which is then concatenated into the generated function body without sufficient sanitization. This allows for the execution of arbitrary JavaScript expressions at template compilation time. While the attack vector is network-based, it typically requires high privileges (PR:H) to influence the template options. The issue is fixed in version 4.17.21.

Affected products

  • lodash lodash < 4.17.21
  • lodash lodash-es < 4.17.21
  • lodash lodash.template <= 4.5.0
  • lodash-rails lodash-rails < 4.17.21

Timeline

  • 2020-11-17: disclosed: Vulnerability disclosed by Marc Hassan
  • 2021-02-15: advisory: NVD and Snyk published advisories
  • 2021-05-06: advisory: GitHub Advisory published

References

Related threats