lodash.template

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

High 8.1

CVE-2026-4800 Public exploit

lodash vulnerable to Code Injection via `_.template` imports key names

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm

Mar 31, 2026
High 7.2

CVE-2021-23337 Public exploit Scanner template EPSS 20%

Command Injection

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

js-jquery lodash node-lodash node-lodash Debian Ubuntu Azure Linux npm RubyGems

Feb 15, 2021