CVE-2021-23337

Command Injection

HIGH

7.2

CVSS Score

Published: February 15, 2021 at 12:15 PM UTC

Updated: October 8, 2026 at 10:17 PM UTC

23 products affected across 4 vendorsActive IQ Unified ManagerPeopleSoft Enterprise PeopleToolsJD Edwards EnterpriseOne Tools

Using Lodash by N/A?

Get instant alerts when new vulnerabilities affect Lodash - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.2

Exploit prediction

EPSS 21%

SSVC

No known exploit

Description

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Lodash · Lodashnpm

95%

v < 4.17.21*

Affected range stops below 4.17.21, so it looks safe — our inference, not a vendor statement

Active IQ Unified Manager · NetAppnpm

95%

Cloud Manager · NetApp

95%

System Manager · NetAppnpm

95%

9.0

Banking Corporate Lending Process Management · Oracle

95%

14.2.0 14.3.0 14.5.0

Banking Credit Facilities Process Management · Oracle

95%

14.2.0 14.3.0 14.5.0

Banking Extensibility Workbench · Oracle

95%

14.2.0 14.3.0 14.5.0

Banking Supply Chain Finance · Oracle

95%

14.2.0 14.3.0 14.5.0

Banking Trade Finance Process Management · Oracle

95%

14.2.0 14.3.0 14.5.0

Communications Cloud Native Core Binding Support Function · Oracle

95%

1.9.0

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (13)

x_refsource_CONFIRMPatchThird Party Advisory

Source: [email protected]

https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf

x_refsource_MISCBroken Link

Source: [email protected]

https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851

x_refsource_CONFIRMThird Party Advisory

Source: [email protected]

https://security.netapp.com/advisory/ntap-20210312-0006/