GHSA-35jh-r3h4-6jhm
Command Injection in lodash
At a glance
- Published
- Updated
- CVE
- CVE-2021-23337
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
`lodash` versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Affected packages
| Package | Versions |
|---|---|
| npm · lodash | introduced 0, fixed 4.17.21 |
| npm · lodash-es | introduced 0, fixed 4.17.21 |
| npm · lodash.template | introduced 0, last affected 4.5.0 |
| npm · lodash-template | introduced 0, last affected 1.0.0 |
| RubyGems · lodash-rails | introduced 0, fixed 4.17.21 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-23337 ADVISORY
- https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c WEB
- https://www.oracle.com/security-alerts/cpuoct2021.html WEB
- https://www.oracle.com/security-alerts/cpujul2022.html WEB
- https://www.oracle.com/security-alerts/cpujan2022.html WEB
- https://www.oracle.com//security-alerts/cpujul2021.html WEB
- https://snyk.io/vuln/SNYK-JS-LODASH-1040724 WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929 WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931 WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928 WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930 WEB
- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932 WEB
- https://security.netapp.com/advisory/ntap-20210312-0006 WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml WEB
- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851 WEB
- https://github.com/lodash/lodash PACKAGE
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |