CVE-2021-23337

HighCVSS 7.2/10Last modified Oct 8, 2026

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

VendorProductVersions
n/aLodashprior to 4.17.21

References

Timeline

Published
Feb 15, 2021
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-233387.2This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function.CVE-2021-233396.5This affects all versions before 10.1.14 and from 10.2.0 to 10.2.4 of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-CVE-2021-23343.5Vulnerability in the Oracle Database - Enterprise Edition Data Redaction component of Oracle Database Server. Supported versions that are afCVE-2021-233407.1This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CVE-2021-233417.5The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tCVE-2021-233426.1This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScrCVE-2021-233437.5All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPCVE-2021-233449.8The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.CVE-2021-233455.3All versions of package github.com/thecodingmachine/gotenberg are vulnerable to Server-side Request Forgery (SSRF) via the /convert/html endCVE-2021-233465.3This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could causeCVE-2021-233474.8The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting (XSS) the SSO CVE-2021-233488.8This affects the package portprocesses before 1.0.5. If (attacker-controlled) user input is given to the killProcess function, it is possibl
CVE-2021-23337: High severity, CVSS 7.2 | Vulnix