StackRadar

GHSA-r5fr-rjxr-66jc

High

Advisory

Published 6 May 2021In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.213
97th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
476
of 17,787 indexed, latest versions
Container images
495
deployed by those charts
Fix available
3 of 3
affected packages

lodash vulnerable to Code Injection via `_.template` imports key names

Carried by container images the latest versions of 476 of 17,787 indexed charts deploy, on 495 images.

Affected packageAffected versionsFixed inImages
lodashnpm0.9.2, 1.0.2, 1.3.1, 2.4.1+13 more4.17.21, 4.18.0487
lodash-esnpm4.17.4, 4.17.15, 4.17.20, 4.17.21+2 more4.17.21, 4.18.0113
lodash.templatenpm2.4.1, 3.6.2, 4.5.0, 4.17.15+1 more4.18.046
OSV records
GHSA-35jh-r3h4-6jhmGHSA-r5fr-rjxr-66jc
Also known as
CVE-2021-23337, CVE-2026-4800

Charts affected

476 by stars
ChartLatestAffected imagesRadar Score
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
lodash@4.17.21
4.18.0

Open the chart page →

5,489
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
lodash@4.17.19
4.17.21

Open the chart page →

2,838
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
lodash@4.17.21
4.18.0

Open the chart page →

17,348
unleash-enterpriseunleash1.0.31 of 1See more

unleash-enterprise unleash 1.0.3

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
unleashorg/unleash-enterprise:7.5.0245aeba40053
lodash@4.17.23
4.18.0

Open the chart page →

2,029
excalidashunxwaresVerified publisher2026.2.51 of 2See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.4.271273af713c91
lodash@4.17.23
4.18.0

Open the chart page →

2,622
kenerunxwaresVerified publisher2026.2.51 of 1See more

kener unxwares 2026.2.5

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
rajnandan1/kener:3.2.1930407afca731
lodash@4.17.21
4.18.0

Open the chart page →

5,234
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
lodash@4.17.21
4.18.0

Open the chart page →

3,747
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
lodash@4.17.21
4.18.0

Open the chart page →

3,129
homarrvhdirkVerified publisher0.1.51 of 1See more

homarr vhdirk 0.1.5

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:lateste103abadfb52
lodash@4.17.21
4.18.0

Open the chart page →

2,789
skoonervhdirkVerified publisher0.1.41 of 1See more

skooner vhdirk 0.1.4

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
ghcr.io/skooner-k8s/skooner:stable60c1562e4d51
lodash@4.17.21
4.18.0

Open the chart page →

1,341
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
lodash-es@4.17.23
4.18.0

Open the chart page →

4,360
n8nvictorlane1.0.181 of 1See more

n8n victorlane 1.0.18

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
n8nio/n8n:1.115.1ed16e560c40e
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0

Open the chart page →

6,470
hedgedocvista0.1.11 of 1See more

hedgedoc vista 0.1.1

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
quay.io/hedgedoc/hedgedoc:1.9.4e09967519a1d
lodash@4.17.21
4.18.0

Open the chart page →

3,119
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0

Open the chart page →

5,774
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.491c8d793746f
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0

Open the chart page →

5,484
queryservice-gatewaywbstack0.2.01 of 1See more

queryservice-gateway wbstack 0.2.0

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
ghcr.io/wbstack/queryservice-gateway:2.2ab8e2f583e56
lodash@4.17.20
4.17.21

Open the chart page →

2,559
webhookiewebhookie0.1.21 of 1See more

webhookie webhookie 0.1.2

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
lodash@4.17.21
4.18.0

Open the chart page →

14,420
webhookie-allwebhookie0.1.21 of 3See more

webhookie-all webhookie 0.1.2

1 of the 3 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
hookiesolutions/webhookie:latest0629694246ba
lodash@4.17.21
4.18.0

Open the chart page →

28,699
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
ubercadence/web:v3.29.58564a5b44a6d
lodash@4.17.20
lodash-es@4.17.20
4.17.21
4.17.21

Open the chart page →

10,127
temporalwenerme0.15.11 of 13See more

temporal wenerme 0.15.1

1 of the 13 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
temporalio/web:1.14.033cfa863d8ce
lodash@4.17.21
lodash-es@4.17.15
4.18.0
4.17.21

Open the chart page →

22,665
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
lodash@4.17.21
4.18.0

Open the chart page →

5,472
kibanawiremindVerified publisher8.5.231 of 2See more

kibana wiremind 8.5.23

1 of the 2 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
library/kibana:8.18.004c0fc150f3a
lodash@4.17.21
4.18.0

Open the chart page →

6,323
opendistro-eswitcom-gmbh1.13.31 of 3See more

opendistro-es witcom-gmbh 1.13.3

1 of the 3 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
amazon/opendistro-for-elasticsearch-kibana:1.13.2c740d7a89475
lodash@4.17.20
lodash-es@4.17.15
4.17.21
4.17.21

Open the chart page →

5,807
workadventureworkadventure1.1.04 of 9See more

workadventure workadventure 1.1.0

4 of the 9 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-back:v1.17.764001369dad5
lodash@4.17.21
4.18.0
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
lodash@4.17.21
4.18.0
thecodingmachine/workadventure-play:v1.17.7d8f66979b9b4
lodash@4.17.21
4.18.0
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
lodash@4.17.21
4.18.0

Open the chart page →

16,083
skoonerxdVerified publisher1.1.01 of 1See more

skooner xd 1.1.0

1 of the 1 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
ymuski/skooner:latest67819ca511b5
lodash@4.17.21
4.18.0

Open the chart page →

1,752
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry GHSA-r5fr-rjxr-66jc.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0

Open the chart page →

9,381

Container images carrying it

495 by charts deploying them

A fixed version is listed for 3 of the 3 affected packages.

Container imageDigestPackageFixed inUsed by
safeglobal/safe-client-gateway-nest:v1.51.012ccfd93fcaf
lodash@4.17.21
4.18.0
1
samajh/alprfrontend:latest05ef4fddbb75
lodash@4.17.21
lodash.template@4.5.0
lodash.template@4.5.0
4.18.0
4.18.0
no fix listed
1
shahanafarooqui/rtl:0.11.0d0cd3d868aca
lodash@4.17.21
4.18.0
1
sharanalwar/redchef-frontend:latest5e82950b16b7
lodash@4.17.21
4.18.0
1
shinobisystems/shinobi:dev3ca746937856
lodash@4.17.21
4.18.0
1
shinobisystems/shinobi:latestc2f5ce2e1067
lodash@4.17.21
4.18.0
1
sigp/siren:v3.0.42c219b04758e
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
siscc/dotstatsuite-data-lifecycle-manager:v14.0.0b6f9a7c888fc
lodash@4.17.21
lodash.template@4.5.0
lodash.template@4.5.0
4.18.0
4.18.0
no fix listed
1
skylenet/ethstats-server:pow-latestd757cc016198
lodash@4.17.21
4.18.0
1
slagattollas/server-practica:latest6dd8ead8e2b1
lodash@4.17.21
4.18.0
1
socialmediamacroscope/smile_graphql:0.3.1c5095e94bc65
lodash@4.17.21
lodash@3.10.1
4.18.0
4.17.21
1
socialmediamacroscope/smile_server:0.3.31a528c794270
lodash@4.17.21
4.18.0
1
solidproject/community-server:6.0.2ccc4acb7e9a1
lodash@4.17.21
4.18.0
1
someblackmagic/alertmanager-to-alerta-bot:latest78bf43744ea5
lodash@4.17.21
lodash@4.17.15
4.18.0
4.17.21
1
someblackmagic/alert-mapper:v0.1.088351d85c04c
lodash@4.17.15
lodash@4.17.15
4.18.0
4.17.21
1
soulou2019/node-server:latest5e6ecfcc109e
lodash@4.17.21
4.18.0
1
soulteary/cronicle:0.9.80ac2512fa6e39
lodash@4.17.21
4.18.0
1
speckle/speckle-frontend-2:2.20.2-branch.testing4.134160-9fad4b210ad4ade8bf2
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-frontend-2:2.20.6-branch.testing1.154030-9b0911432fc940d9b4c
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-frontend-2:2.19.2-branch.hotfix-2.19.1.124125-665e7e14f9241665ae3
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-frontend-2:2.21.3-branch.testing5.219631-2153befd4ca6ebf09b9
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-frontend-2:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbfdc008effc7a
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-monitor-deployment:2.25.10-branch.testing6.645-b125c1e2dbc553ed87c
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-monitor-deployment:2.26.3d51e1b0cf231
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-preview-service:2.26.3092384dba45d
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-server:2.25.10-branch.testing6.645-b125c1e75cdf256067b
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-server:2.26.379f14a2bf931
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-webhook-service:2.21.3-branch.testing5.219631-2153bef06ecc7a66a40
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-webhook-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb107c63336ab5
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-webhook-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e14828aee2277c
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-webhook-service:2.20.2-branch.testing4.134160-9fad4b270f5167d1d4d
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-webhook-service:2.18.12-branch.testing3.88744-f55b341771f872cfa63
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-webhook-service:2.18.11-branch.testing2.88634-335d469902b98ad5327
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1
speckle/speckle-webhook-service:2.17.14-branch.testing.72707.921a5f899913052b72e
lodash@4.17.21
lodash-es@4.17.21
4.18.0
4.18.0
1

syft 1.42.1 · advisories as of 15 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.