Command Injection in lodash

Description

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Recommendation

Update the lodash package to the latest compatible version. Followings are version details:

• Affected version(s): < 4.17.21
• Patched version(s): 4.17.21

References

• GHSA-35jh-r3h4-6jhm
• snyk.io
• www.oracle.com
• cert-portal.siemens.com
• security.netapp.com
• CVE-2021-23337
• CWE-77
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Command Injection in lodash (GHSA-35jh-r3h4-6jhm) - CVE-2021-23337
• Command Injection Vulnerability in systeminformation - CVE-2021-21388
• Command Injection Vulnerability - CVE-2021-21315
• Command injection in launchpad - CVE-2021-23330

Tags:

npm

lodash