PatchTheCVECVE-2021-23337: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
55
This week
HIGH 7.2UPGRADEDOWNGRADEDOWNGRADE
CVE-2021-23337 is a high-severity flaw (CVSS 7.2) affecting lodash, banking corporate lending process management, banking credit facilities process management. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Why this priority
- High severity
- EPSS top 2%: very likely to be exploited
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.2 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 21.3% (top 2%) |
| CISA exploited list | No |
| Weakness | CWE-94 |
| Published | 2021-02-15 |
| Last modified | 2026-10-08 |
Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
lodash lodash UPGRADE
Affected: < 4.17.21
Fixed in: 4.17.21
Safe to downgrade to: no unaffected older release
1. Check installed version
npm ls lodash
2. UPGRADE to 4.17.21
npm install lodash@">=4.17.21"
oracle banking corporate lending process management DOWNGRADE
Affected: 14.2.0 · 14.3.0 · 14.5.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 14.2.0
1. Check installed version
apt-cache policy banking-corporate-lending-process-management || rpm -q banking-corporate-lending-process-management || banking-corporate-lending-process-management --version
2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)
apt-cache madison banking-corporate-lending-process-management
sudo apt install banking-corporate-lending-process-management=<VERSION_BEFORE_14.2.0>
sudo apt-mark hold banking-corporate-lending-process-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list banking-corporate-lending-process-management
sudo dnf downgrade banking-corporate-lending-process-management-<VERSION_BEFORE_14.2.0>
sudo dnf versionlock add banking-corporate-lending-process-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle banking credit facilities process management DOWNGRADE
Affected: 14.2.0 · 14.3.0 · 14.5.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 14.2.0
1. Check installed version
apt-cache policy banking-credit-facilities-process-management || rpm -q banking-credit-facilities-process-management || banking-credit-facilities-process-management --version
2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)
apt-cache madison banking-credit-facilities-process-management
sudo apt install banking-credit-facilities-process-management=<VERSION_BEFORE_14.2.0>
sudo apt-mark hold banking-credit-facilities-process-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list banking-credit-facilities-process-management
sudo dnf downgrade banking-credit-facilities-process-management-<VERSION_BEFORE_14.2.0>
sudo dnf versionlock add banking-credit-facilities-process-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle banking extensibility workbench DOWNGRADE
Affected: 14.2.0 · 14.3.0 · 14.5.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 14.2.0
1. Check installed version
apt-cache policy banking-extensibility-workbench || rpm -q banking-extensibility-workbench || banking-extensibility-workbench --version
2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)
apt-cache madison banking-extensibility-workbench
sudo apt install banking-extensibility-workbench=<VERSION_BEFORE_14.2.0>
sudo apt-mark hold banking-extensibility-workbench
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list banking-extensibility-workbench
sudo dnf downgrade banking-extensibility-workbench-<VERSION_BEFORE_14.2.0>
sudo dnf versionlock add banking-extensibility-workbench
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle banking supply chain finance DOWNGRADE
Affected: 14.2.0 · 14.3.0 · 14.5.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 14.2.0
1. Check installed version
apt-cache policy banking-supply-chain-finance || rpm -q banking-supply-chain-finance || banking-supply-chain-finance --version
2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)
apt-cache madison banking-supply-chain-finance
sudo apt install banking-supply-chain-finance=<VERSION_BEFORE_14.2.0>
sudo apt-mark hold banking-supply-chain-finance
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list banking-supply-chain-finance
sudo dnf downgrade banking-supply-chain-finance-<VERSION_BEFORE_14.2.0>
sudo dnf versionlock add banking-supply-chain-finance
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle banking trade finance process management DOWNGRADE
Affected: 14.2.0 · 14.3.0 · 14.5.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 14.2.0
1. Check installed version
apt-cache policy banking-trade-finance-process-management || rpm -q banking-trade-finance-process-management || banking-trade-finance-process-management --version
2. No fixed release: DOWNGRADE to a release before 14.2.0 (Debian / Ubuntu)
apt-cache madison banking-trade-finance-process-management
sudo apt install banking-trade-finance-process-management=<VERSION_BEFORE_14.2.0>
sudo apt-mark hold banking-trade-finance-process-management
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list banking-trade-finance-process-management
sudo dnf downgrade banking-trade-finance-process-management-<VERSION_BEFORE_14.2.0>
sudo dnf versionlock add banking-trade-finance-process-management
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: Lodash Template - Server-Side Template Injection (RCE)
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-23337?
lodash: upgrade to 4.17.21; banking corporate lending process management: downgrade or apply the listed mitigation; banking credit facilities process management: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2021-23337 being exploited?
CVE-2021-23337 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-23337 affect?
CVE-2021-23337 affects lodash, banking corporate lending process management, banking credit facilities process management. Severity is high (CVSS 7.2). Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
How urgent is CVE-2021-23337?
Priority 55/100. High severity; EPSS top 2%: very likely to be exploited; Public exploit reference
Software pages
Related CVEs
- CVE-2025-13465 MEDIUM 5.3 UPGRADE The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution
- CVE-2020-28500 MEDIUM 5.3 UPGRADE DOWNGRADE Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumb
- CVE-2020-8203 HIGH 7.4 UPGRADE DOWNGRADE Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
- CVE-2019-10744 CRITICAL 9.1 UPGRADE MITIGATE Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution
- CVE-2019-1010266 MEDIUM 6.5 UPGRADE lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption