CVE-2021-23337

High

Advisory

Published 15 Feb 2021In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.1; base score, highest
EPSS: 0.213; 97th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 474; of 17,781 indexed, latest versions
Container images: 493; deployed by those charts
Fix available: 4 of 4; affected packages

lodash vulnerable to Code Injection via `_.template` imports key names

Carried by container images the latest versions of 474 of 17,781 indexed charts deploy, on 493 images.

Affected package	Affected versions	Fixed in	Images
lodashnpm	0.9.2, 1.0.2, 1.3.1, 2.4.1+13 more	4.17.21, 4.18.0	485
lodash-esnpm	4.17.4, 4.17.15, 4.17.20, 4.17.21+2 more	4.17.21, 4.18.0	112
lodash.templatenpm	2.4.1, 3.6.2, 4.5.0, 4.17.15+1 more	4.18.0	45
node-lodashdeb	4.17.15+dfsg-2	4.17.15+dfsg-2ubuntu0.1~esm1	2

OSV records: GHSA-35jh-r3h4-6jhm GHSA-r5fr-rjxr-66jc UBUNTU-CVE-2021-23337
Also known as: CVE-2026-4800, USN-8411-1

Charts affected

474 by stars

Chart

Latest

Affected images

Radar Score

kubernetes-external-secretstrozz

6.3.0

1 of 1 See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
ghcr.io/external-secrets/kubernetes-external-secrets :6.3.0	eab9bd0b6986	lodash@4.17.19	4.17.21

Open the chart page →

2,838

tfy-distributortruefoundry

0.0.1

1 of 4 See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	lodash@4.17.21	4.18.0

Open the chart page →

17,323

unleash-enterpriseunleash

1.0.3

1 of 1 See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
unleashorg/unleash-enterprise :7.5.0	245aeba40053	lodash@4.17.23	4.18.0

Open the chart page →

2,028

excalidashunxwares

2026.2.5

1 of 2 See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
zimengxiong/excalidash-backend :0.4.27	1273af713c91	lodash@4.17.23	4.18.0

Open the chart page →

2,620

kenerunxwares

2026.2.5

1 of 1 See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
rajnandan1/kener :3.2.19	30407afca731	lodash@4.17.21	4.18.0

Open the chart page →

5,228

evolution-apivcnngr

1.0.0

1 of 5 See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
evoapicloud/evolution-api :latest	966625532d90	lodash@4.17.21	4.18.0

Open the chart page →

3,746

genievhdirk

0.1.3

1 of 1 See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
stanfordoval/almond-server :latest	1a63cdccedaf	lodash@4.17.21	4.18.0

Open the chart page →

3,129

homarrvhdirk

0.1.5

1 of 1 See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
ghcr.io/ajnart/homarr :latest	e103abadfb52	lodash@4.17.21	4.18.0

Open the chart page →

2,789

skoonervhdirk

0.1.4

1 of 1 See more

skooner vhdirk 0.1.4

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
ghcr.io/skooner-k8s/skooner :stable	60c1562e4d51	lodash@4.17.21	4.18.0

Open the chart page →

1,341

browserlessvictorlane

0.2.0

1 of 1 See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
ghcr.io/browserless/chromium :v2.43.0	853e6f105b51	lodash-es@4.17.23	4.18.0

Open the chart page →

4,305

hedgedocvista

0.1.1

1 of 1 See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
quay.io/hedgedoc/hedgedoc :1.9.4	e09967519a1d	lodash@4.17.21	4.18.0

Open the chart page →

3,118

sirenwateim

1.0.2

1 of 1 See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
sigp/siren :v3.0.4	2c219b04758e	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0

Open the chart page →

5,984

wazuhwazuh-helm-eks

1.2.10

1 of 6 See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0

Open the chart page →

5,484

queryservice-gatewaywbstack

0.2.0

1 of 1 See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
ghcr.io/wbstack/queryservice-gateway :2.2	ab8e2f583e56	lodash@4.17.20	4.17.21

Open the chart page →

2,559

webhookiewebhookie

0.1.2

1 of 1 See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	lodash@4.17.21	4.18.0

Open the chart page →

14,364

webhookie-allwebhookie

0.1.2

1 of 3 See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
hookiesolutions/webhookie :latest	0629694246ba	lodash@4.17.21	4.18.0

Open the chart page →

28,605

cadencewenerme

0.23.0

1 of 5 See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
ubercadence/web :v3.29.5	8564a5b44a6d	lodash@4.17.20 lodash-es@4.17.20	4.17.21 4.17.21

Open the chart page →

10,127

temporalwenerme

0.15.1

1 of 13 See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
temporalio/web :1.14.0	33cfa863d8ce	lodash@4.17.21 lodash-es@4.17.15	4.18.0 4.17.21

Open the chart page →

22,665

wikiwikijs

3.0.0

1 of 2 See more

5,459

kibanawiremind

8.5.23

1 of 2 See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
library/kibana :8.18.0	04c0fc150f3a	lodash@4.17.21	4.18.0

Open the chart page →

6,285

opendistro-eswitcom-gmbh

1.13.3

1 of 3 See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
amazon/opendistro-for-elasticsearch-kibana :1.13.2	c740d7a89475	lodash@4.17.20 lodash-es@4.17.15	4.17.21 4.17.21

Open the chart page →

5,806

workadventureworkadventure

1.1.0

4 of 9 See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-back :v1.17.7	64001369dad5	lodash@4.17.21	4.18.0
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	lodash@4.17.21	4.18.0
thecodingmachine/workadventure-play :v1.17.7	d8f66979b9b4	lodash@4.17.21	4.18.0
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	lodash@4.17.21	4.18.0

Open the chart page →

16,083

skoonerxd

1.1.0

1 of 1 See more

1,752

ygdrassil-monitoringygdrassil

0.4.0

1 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2021-23337.

Container image	Digest	Package	Fixed in
opensearchproject/opensearch-dashboards :2.18.0	0ecd8444add2	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0

Open the chart page →

9,381

Container images carrying it

493 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
mojaloop/event-sidecar :v11.0.1	89b8ab71b74b	lodash@4.17.21	4.18.0	5
hyperledger/fabric-ca-tools :latest	4ce6f43ded2e	lodash@3.10.1	4.17.21	4
hyperledger/fabric-couchdb :0.4.15	f6c724592abf	lodash@3.10.1	4.17.21	4
oscarsotosanchez/server :v1.0	6e2e1279126b	lodash@4.17.21	4.18.0	4
redis/redisinsight :3.8 :latest	b5e19ee240ab	lodash@4.17.21	4.18.0	4
ghcr.io/advplyr/audiobookshelf :2.36.0	180acad33d69	lodash@4.17.21	4.18.0	4
ghcr.io/skooner-k8s/skooner :stable	60c1562e4d51	lodash@4.17.21	4.18.0	4
assistiot/dlt_api :2.0.0	e36a8922fa0c	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	3
mojaloop/account-lookup-service :v11.8.0	b06d3287ea82	lodash@4.17.21	4.18.0	3
pantsel/konga :latest	c8172b75607d	lodash@4.17.15 lodash@2.4.1	4.18.0 4.17.21	3
rcdelacruz/my-strapi-app :js-amd64	38007f358355	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	3
ghcr.io/kamilkisiela/graphql-hive/app :59b64c36c866b3555c135c70de76a884e63f8619	a4a3639899f7	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	3
ghcr.io/seerr-team/seerr :latest :v3.4.1	f4768de5f616	lodash-es@4.17.23	4.18.0	3
quay.io/devtron/notifier :9804331c-372-39294	709c7da19c5a	lodash@4.17.23	4.18.0	3
agoldis/sorry-cypress-api :2.5.11	afaa5a84051d	lodash@4.17.21	4.18.0	2
agoldis/sorry-cypress-director :2.5.11	10228ecd353b	lodash@4.17.21	4.18.0	2
amazon/opendistro-for-elasticsearch-kibana :1.13.2	c740d7a89475	lodash@4.17.20 lodash-es@4.17.15 lodash@4.17.20 lodash-es@4.17.15	4.18.0 4.18.0 4.17.21 4.17.21	2
chatwoot/chatwoot :v3.1.0	d530ab8c1753	lodash@4.17.21	4.18.0	2
ethersphere/bee-localchain :latest	0558799ca992	lodash@4.17.21	4.18.0	2
gjeanmart/safe-ganache-node :latest	926264c8f2d1	lodash@4.17.21	4.18.0	2
governify/assets-manager :v1.4.1	2987672448c7	lodash@4.17.21 lodash@4.17.20	4.18.0 4.17.21	2
governify/director :v1.4.0	608c6940bb98	lodash@4.17.21	4.18.0	2
governify/registry :v3.4.0	d3f37f4f8168	lodash@4.17.21 lodash@4.17.20	4.18.0 4.17.21	2
governify/render :v2.2.0	daeca1ce28e6	lodash@4.17.21	4.18.0	2
governify/reporter :v2.2.0	38595913458f	lodash@4.17.21 lodash@4.17.20	4.18.0 4.17.21	2
gradiant/open5gs-webui :2.7.5	fbd10c017541	lodash@4.17.21	4.18.0	2
hookiesolutions/webhookie :latest	0629694246ba	lodash@4.17.21	4.18.0	2
hoppscotch/hoppscotch :2024.8.2	f1da831950b7	lodash@4.17.21	4.18.0	2
htmlprogrammer2001/simple-db-app :1.0	a7e0a233a9bc	lodash@4.17.21	4.18.0	2
l7mp/kurento-one2one-call-server :latest	fd2b2d06fff6	lodash@4.17.21 lodash@3.10.1	4.18.0 4.17.21	2
library/arangodb :3.11.8	1e75d74954a4	lodash@4.17.21	4.18.0	2
library/mongo-express :1.0.2 :latest	1b23d7976f02	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	2
louislam/uptime-kuma :2.5.4	917318f9d7be	lodash@4.17.23	4.18.0	2
louislam/uptime-kuma :2.3.2	9aeb4e51d038	lodash@4.17.23	4.18.0	2
louislam/uptime-kuma :2.5.0	a8610b3b4c38	lodash@4.17.23	4.18.0	2
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	lodash@4.17.15 lodash-es@4.17.15 lodash.template@4.5.0 lodash@4.17.15 lodash-es@4.17.15 lodash.template@4.5.0	4.18.0 4.18.0 4.18.0 4.17.21 4.17.21 no fix listed	2
mesosphere/kommander :6.100.1	3917e82333a9	lodash@4.17.21	4.18.0	2
migmartri/prerender :latest	486aacfd5aa9	lodash@4.17.4 lodash@4.17.4	4.18.0 4.17.21	2
mojaloop/central-ledger :v13.14.0	1abc8a7aa71c	lodash@4.17.21	4.18.0	2
mojaloop/ml-api-adapter :v11.1.6	fb71d233c742	lodash@4.17.21	4.18.0	2
mojaloop/reporting :v12.1.0	d480a62103d6	lodash@3.10.1	4.17.21	2
mojaloop/reporting-aggregator-svc :v0.0.9	2635baf23298	lodash@4.17.21	4.18.0	2
mojaloop/reporting-events-processor-svc :v3.5.1	1e0d24d28512	lodash@4.17.21	4.18.0	2
mojaloop/reporting-hub-bop-api-svc :v4.1.2	b45a2d6f0f2a	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	2
mojaloop/reporting-hub-bop-experience-api-svc :v2.0.4	265102a049d6	lodash@4.17.21	4.18.0	2
mojaloop/role-assignment-service :v2.1.0	def4bf273721	lodash@4.17.21	4.18.0	2
mojaloop/security-role-perm-operator-svc :v3.0.2	12af60892c75	lodash@4.17.21	4.18.0	2
moreillon/user-manager :v5.0.2	e1c9bfab5c16	lodash@4.17.21	4.18.0	2
opensearchproject/opensearch-dashboards :1.0.0	39695180364b	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	2
outlinewiki/outline :0.69.1	d060dcd8f9aa	lodash@4.17.21 lodash-es@4.17.21	4.18.0 4.18.0	2