GHSA-35jh-r3h4-6jhm
HighAdvisory
Published 6 May 2021In the index since 5 Sept 2026
- Severity
- High
- worst across findings
- CVSS
- 8.1
- base score, highest
- EPSS
- 0.213
- 97th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 473
- of 17,787 indexed, latest versions
- Container images
- 492
- deployed by those charts
- Fix available
- 3 of 3
- affected packages
lodash vulnerable to Code Injection via `_.template` imports key names
Carried by container images the latest versions of 473 of 17,787 indexed charts deploy, on 492 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| lodashnpm | 0.9.2, 1.0.2, 1.3.1, 2.4.1+13 more | 4.17.21, 4.18.0 | 485 |
| lodash-esnpm | 4.17.4, 4.17.15, 4.17.20, 4.17.21+2 more | 4.17.21, 4.18.0 | 113 |
| lodash.templatenpm | 2.4.1, 3.6.2, 4.5.0, 4.17.15+1 more | 4.18.0 | 44 |
- OSV records
- GHSA-35jh-r3h4-6jhmGHSA-r5fr-rjxr-66jc
- Also known as
- CVE-2021-23337, CVE-2026-4800
Charts affected
473 by stars
Container images carrying it
492 by charts deploying them
A fixed version is listed for 3 of the 3 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| speckle/ | dd9db6cbe9bb | lodash lodash-es | 4.18.0 4.18.0 | 1 |
| sqlpad/ | d3d2f430dffd | lodash lodash | 4.18.0 4.17.21 | 1 |
| stanfordoval/ | 1a63cdccedaf | lodash | 4.18.0 | 1 |
| subsquid/ | a7f8b9bad7ee | lodash | 4.18.0 | 1 |
| supabase/ | f983fb50bd95 | lodash | 4.18.0 | 1 |
| supabase/ | 26d8070c55e9 | lodash | 4.18.0 | 1 |
| svenwal/ | ba2f285af432 | lodash | 4.18.0 | 1 |
| svtechnmaa/ | 1d71314424aa | lodash lodash.template lodash | 4.18.0 4.18.0 4.17.21 | 1 |
| sysnet4admin/ | e74b43c7f492 | lodash | 4.18.0 | 1 |
| sysnet4admin/ | 5802bfcd7fed | lodash | 4.18.0 | 1 |
| temporalio/ | 33cfa863d8ce | lodash lodash-es lodash-es | 4.18.0 4.18.0 4.17.21 | 1 |
| testhubio/ | e86c2db53be8 | lodash lodash.template lodash lodash.template | 4.18.0 4.18.0 4.17.21 no fix listed | 1 |
| thecodingmachine/ | 64001369dad5 | lodash | 4.18.0 | 1 |
| thecodingmachine/ | 5bdab56da2fa | lodash | 4.18.0 | 1 |
| thecodingmachine/ | d8f66979b9b4 | lodash | 4.18.0 | 1 |
| thecodingmachine/ | 3ccd467543b3 | lodash | 4.18.0 | 1 |
| thelounge/ | 0037aa258261 | lodash | 4.18.0 | 1 |
| thelounge/ | 639978459c3a | lodash lodash | 4.18.0 4.17.21 | 1 |
| thmmniii/ | a347f7f4d144 | lodash | 4.18.0 | 1 |
| timothyclarke/ | 22c41e5ca7e2 | lodash lodash | 4.18.0 4.17.21 | 1 |
| tooljet/ | c85a4720e42e | lodash | 4.18.0 | 1 |
| treskon/ | e7970783bc8d | lodash | 4.18.0 | 1 |
| tzahi12345/ | 3720b856bd2f | lodash lodash | 4.18.0 4.17.21 | 1 |
| ubercadence/ | 8564a5b44a6d | lodash lodash-es lodash lodash-es | 4.18.0 4.18.0 4.17.21 4.17.21 | 1 |
| unitycatalog/ | 3a688197b218 | lodash | 4.18.0 | 1 |
| unleashorg/ | 245aeba40053 | lodash | 4.18.0 | 1 |
| unleashorg/ | 9adb37e399ba | lodash | 4.18.0 | 1 |
| vabene1111/ | ec4e9e2905b0 | lodash lodash.template lodash.template | 4.18.0 4.18.0 no fix listed | 1 |
| visualregressiontracker/ | 941aeb8c8bf9 | lodash | 4.18.0 | 1 |
| vlebediantsev/ | 007c6670ff48 | lodash | 4.18.0 | 1 |
| vlebediantsev/ | 945675fd2636 | lodash | 4.18.0 | 1 |
| vlebediantsev/ | 54f69d116c50 | lodash | 4.18.0 | 1 |
| wazuh/ | 0c58e7b47bb6 | lodash lodash-es | 4.18.0 4.18.0 | 1 |
| wazuh/ | 1787550d2358 | lodash lodash-es | 4.18.0 4.18.0 | 1 |
| wazuh/ | 91c8d793746f | lodash lodash-es | 4.18.0 4.18.0 | 1 |
| wazuh/ | 91e4f0a7feed | lodash lodash-es | 4.18.0 4.18.0 | 1 |
| wekanteam/ | 68a51f0327df | lodash lodash lodash.template | 4.18.0 4.17.21 no fix listed | 1 |
| willwill/ | d443017aae98 | lodash lodash | 4.18.0 4.17.21 | 1 |
| winfred008/ | 10a68de5b398 | lodash | 4.18.0 | 1 |
| wiremind/ | e7048929a676 | lodash lodash lodash.template | 4.18.0 4.17.21 no fix listed | 1 |
| xom4ekp2p/ | d0e0aa238b02 | lodash | 4.18.0 | 1 |
| ymuski/ | 67819ca511b5 | lodash | 4.18.0 | 1 |
| youssef11gaber10/ | ba6853e35c60 | lodash | 4.18.0 | 1 |
| yuzutech/ | 57917319ea70 | lodash-es | 4.18.0 | 1 |
| yuzutech/ | 963b4acfde6e | lodash | 4.18.0 | 1 |
| zazuko/ | 054be137de70 | lodash | 4.18.0 | 1 |
| zimengxiong/ | 1273af713c91 | lodash | 4.18.0 | 1 |
| zooz/ | f491d1f7a865 | lodash | 4.18.0 | 1 |
| zwavejs/ | 15a6040fb468 | lodash | 4.18.0 | 1 |
| zwavejs/ | 14d018bb689e | lodash | 4.18.0 | 1 |