CVE-2021-23337: Lodash

High severity, CVSS 7.2. EPSS: 21.3% chance of exploitation in the next 30 days.

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Affected products

  • Lodash Lodash: before 4.17.21 (fixed in 4.17.21)
  • Netapp Active Iq Unified Manager: affected versions not specified
  • Netapp Cloud Manager: affected versions not specified
  • Netapp System Manager: version 9.0 only
  • Oracle Banking Corporate Lending Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Banking Credit Facilities Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Banking Extensibility Workbench: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Banking Supply Chain Finance: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Banking Trade Finance Process Management: version 14.2.0 only; version 14.3.0 only; version 14.5.0 only
  • Oracle Communications Cloud Native Core Binding Support Function: version 1.9.0 only
  • Oracle Communications Cloud Native Core Policy: version 1.11.0 only
  • Oracle Communications Design Studio: version 7.4.2.0.0 only
  • Oracle Communications Services Gatekeeper: version 7.0 only
  • Oracle Communications Session Border Controller: version 8.4 only; version 9.0 only
  • Oracle Enterprise Communications Broker: version 3.2.0 only; version 3.3.0 only
  • Oracle Financial Services Crime And Compliance Management Studio: version 8.0.8.2.0 only; version 8.0.8.3.0 only
  • Oracle Health Sciences Data Management Workbench: version 2.5.2.1 only; version 3.0.0.0 only
  • Oracle Jd Edwards Enterpriseone Tools: before 9.2.6.1 (fixed in 9.2.6.1)
  • Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only; version 8.59 only
  • Oracle Primavera Gateway: from 17.12.0, up to and including 17.12.11; from 18.8.0, up to and including 18.8.12; from 19.12.0, up to and including 19.12.11; from 20.12.0, up to and including 20.12.7
  • Oracle Primavera Unifier: from 17.7, up to and including 17.12; version 18.8 only; version 19.12 only; version 20.12 only
  • Oracle Retail Customer Management And Segmentation Foundation: version 19.0 only
  • Siemens Sinec Ins: before 1.0 (fixed in 1.0); version 1.0 only

Published 2021-02-15. Last modified 2026-10-08.