GHSA-35jh-r3h4-6jhm
HighAdvisory
Published 6 May 2021In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.1
- base score, highest
- EPSS
- 0.213
- 97th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 474
- of 17,781 indexed, latest versions
- Container images
- 493
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
lodash vulnerable to Code Injection via `_.template` imports key names
Carried by container images the latest versions of 474 of 17,781 indexed charts deploy, on 493 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| lodashnpm | 0.9.2, 1.0.2, 1.3.1, 2.4.1+13 more | 4.17.21, 4.18.0 | 485 |
| lodash-esnpm | 4.17.4, 4.17.15, 4.17.20, 4.17.21+2 more | 4.17.21, 4.18.0 | 112 |
| lodash.templatenpm | 2.4.1, 3.6.2, 4.5.0, 4.17.15+1 more | 4.18.0 | 45 |
- OSV records
- GHSA-35jh-r3h4-6jhmGHSA-r5fr-rjxr-66jc
- Also known as
- CVE-2021-23337, CVE-2026-4800
Charts affected
474 by stars
Container images carrying it
493 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| rajnandan1/ | 30407afca731 | lodash | 4.18.0 | 2 |
| redis/ | 1c5f43fddcdd | lodash | 4.18.0 | 2 |
| requarks/ | 68f0d1848261 | lodash | 4.18.0 | 2 |
| shahanafarooqui/ | e2195188a451 | lodash | 4.18.0 | 2 |
| speckle/ | 4bd113093583 | lodash lodash-es | 4.18.0 4.18.0 | 2 |
| stakater/ | 3f4926eedc74 | lodash | 4.18.0 | 2 |
| statsd/ | dab129e74c25 | lodash lodash | 4.18.0 4.17.21 | 2 |
| taskrabbit/ | c967fe68b9c7 | lodash lodash | 4.18.0 4.17.21 | 2 |
| tzahi12345/ | 2f943d584711 | lodash | 4.18.0 | 2 |
| ghcr.io/ | 81afafdd96a5 | lodash lodash-es | 4.18.0 4.18.0 | 2 |
| ghcr.io/ | acb40032ad4b | lodash lodash.template lodash.template | 4.18.0 4.18.0 no fix listed | 2 |
| quay.io/ | e09967519a1d | lodash | 4.18.0 | 2 |
| 0hlov3/ | 50f874ec096b | lodash | 4.18.0 | 1 |
| activepieces/ | c26188b44e62 | lodash | 4.18.0 | 1 |
| actualbudget/ | 58fecd9088b7 | lodash | 4.18.0 | 1 |
| adeptiainc/ | 31f295e948e6 | lodash-es | 4.18.0 | 1 |
| amazon/ | 5126e2e79a1f | lodash lodash-es lodash lodash-es | 4.18.0 4.18.0 4.17.21 4.17.21 | 1 |
| amundsendev/ | 69e7915e61c1 | lodash lodash | 4.18.0 4.17.21 | 1 |
| aolde/ | dc61ee713720 | lodash | 4.18.0 | 1 |
| apecloud/ | b3ae37840ace | lodash | 4.18.0 | 1 |
| apimap/ | 406d3858e20c | lodash | 4.18.0 | 1 |
| apimap/ | 041a4790c65c | lodash | 4.18.0 | 1 |
| archivebox/ | 1a5a37331091 | lodash | 4.18.0 | 1 |
| arfath29/ | 384b3e377f47 | lodash lodash.template lodash.template | 4.18.0 4.18.0 no fix listed | 1 |
| arturisimo/ | d8dc4430531e | lodash | 4.18.0 | 1 |
| assistiot/ | 2297b4350211 | lodash lodash-es lodash lodash-es | 4.18.0 4.18.0 4.17.21 4.17.21 | 1 |
| assistiot/ | 0570b27bb7c2 | lodash lodash | 4.18.0 4.17.21 | 1 |
| assistiot/ | c8a170683be7 | lodash lodash-es | 4.18.0 4.18.0 | 1 |
| assistiot/ | 7473d77448e1 | lodash | 4.18.0 | 1 |
| assistiot/ | f11d82defc70 | lodash | 4.18.0 | 1 |
| assistiot/ | 4f41e1defe99 | lodash | 4.18.0 | 1 |
| assistiot/ | 89f37e88c871 | lodash | 4.18.0 | 1 |
| assistiot/ | a8b8dbed04a4 | lodash | 4.18.0 | 1 |
| automatischio/ | 3bace7a12d5f | lodash lodash-es | 4.18.0 4.18.0 | 1 |
| baserow/ | df0c42eb67e8 | lodash lodash.template lodash.template | 4.18.0 4.18.0 no fix listed | 1 |
| bastilimbach/ | 41b0835ab31e | lodash lodash | 4.18.0 4.17.21 | 1 |
| bicarus/ | dab88659ae3b | lodash lodash-es | 4.18.0 4.18.0 | 1 |
| billimek/ | 5814f0bcf5ba | lodash | 4.17.21 | 1 |
| browserless/ | c81ae5585b47 | lodash | 4.18.0 | 1 |
| budibase/ | 44fe6feab985 | lodash | 4.18.0 | 1 |
| budibase/ | de5e2e560ce8 | lodash | 4.18.0 | 1 |
| carbonetes/ | 1b9b93c9a37f | lodash | 4.18.0 | 1 |
| catalysm/ | f003b35f54d9 | lodash lodash.template lodash lodash.template | 4.18.0 4.18.0 4.17.21 no fix listed | 1 |
| ccjacobs14/ | 9a9b14a6f09e | lodash | 4.18.0 | 1 |
| chainsafe/ | 5593f6e97912 | lodash | 4.18.0 | 1 |
| chainsafe/ | 7b9fe4aa8073 | lodash | 4.18.0 | 1 |
| chandanteekinavar/ | 49e164a9a439 | lodash | 4.18.0 | 1 |
| chatwoot/ | 67ebc751c171 | lodash | 4.18.0 | 1 |
| chibisafe/ | 3da4fcbc1a18 | lodash | 4.18.0 | 1 |
| chocobozzz/ | 052712130691 | lodash | 4.18.0 | 1 |