{"action":"Upgrade lodash-es to 4.17.21 or later.","affected":[{"fixed":"4.17.21","introduced":"0"}],"component":"lodash-es","cve_ids":["CVE-2021-23337"],"ecosystem":"npm","exploited":false,"fixed_versions":["4.17.21"],"ghsa_id":"GHSA-35jh-r3h4-6jhm","id":"tcs_01M5KEG6VVNP6B9BJXS71THY5S","modified_at":"2026-10-17T02:55:38.085813876Z","published_at":"2021-05-06T16:05:51Z","references":["https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm","https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com//security-alerts/cpujul2021.html","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://github.com/lodash/lodash","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"GHSA-35jh-r3h4-6jhm#npm/lodash-es","url":"https://osv.dev/vulnerability/GHSA-35jh-r3h4-6jhm"}],"summary":"Command Injection in lodash"}