CVE-2021-23337 Command Injection
Attackers can execute arbitrary commands via the template function in the Lodash JavaScript library, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23337?
CVE-2021-23337 is a high-severity command injection vulnerability in Netapp Active Iq Unified Manager, published on 15 Feb 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Weakness: CWE-94
Which versions are affected by CVE-2021-23337?
10 open source packages ship an affected version, including lodash-rails, lodash and lodash-es. It affects 23 products.
| Package | Affected | Fixed in |
|---|---|---|
lodash-rails RubyGems | All versions | 4.17.21 |
lodash-rails RubyGems | All versions | 4.17.21 |
lodash npm | All versions | 4.17.21 |
lodash npm | All versions | 4.17.21 |
lodash-es npm | All versions | 4.17.21 |
lodash-es npm | All versions | 4.17.21 |
4 more packages
lodash-template npm | All versions to 1.0.0 | None |
lodash-template npm | All versions to 1.0.0 | None |
lodash.template npm | All versions to 4.5.0 | None |
lodash.template npm | All versions to 4.5.0 | None |
Products include Lodash Lodash, Netapp Active Iq Unified Manager, Netapp Cloud Manager, Netapp System Manager, Oracle Banking Corporate Lending Process Management, Oracle Banking Credit Facilities Process Management and 17 more.
How do I fix CVE-2021-23337?
Upgrade lodash-rails to 4.17.21 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-23337 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-23337 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Netapp Active Iq Unified Manager
- CVE-2026-4800 lodash vulnerable to Code Injection via `_.template` imports key names
- CVE-2020-8203 Prototype Pollution in lodash
- CVE-2025-13465 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
- CVE-2026-2950 lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
- CVE-2019-1010266 Regular Expression Denial of Service (ReDoS) in lodash
Sources
Also known as AZL-44655, CLSA-2026-1775003202, CLSA-2026-1784682758, DEBIAN-CVE-2021-23337, GHSA-35jh-r3h4-6jhm, MINI-c9vg-9mv6-rq7w and 4 more.