Outdated Lodash Library Allows Attackers to Run Malicious Code on Your Server

Vulnerability Explanation

The _.template() function in Lodash accepted a user-controlled 'variable' option without proper validation. By crafting a malicious value for this option, an attacker could break out of the template sandbox and inject arbitrary JavaScript or OS-level commands that execute in the context of the Node.js process. The attack requires the attacker to control input passed to _.template() — typically meaning they need some authenticated or privileged access to the application, but the impact once triggered is full command execution on the host.

Root Cause

The _.template() function used the 'variable' option to scope template data, but failed to validate or sanitize this value before incorporating it into a dynamically constructed Function() call. This allowed injection of arbitrary code into the generated function body — a classic code injection pattern stemming from unsafe dynamic code generation (CWE-94 / CWE-77).

Technical Impact

A remote authenticated attacker can execute arbitrary OS commands on the server running the Node.js application. Successful exploitation can lead to full confidentiality, integrity, and availability compromise of the affected system — including data exfiltration, data manipulation, and denial of service.

Severity Justification

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H — Network-reachable, low complexity, but requires high privileges. A public proof-of-concept exploit exists, making this realistically exploitable where the preconditions are met.

Affected Components

• lodash < 4.17.21
• lodash.template < 4.5.0 (standalone package)

Remediation Steps

1. Upgrade lodash to 4.17.21 or later in your package.json: run `npm install lodash@latest` or `yarn add lodash@latest`.
2. If using the standalone `lodash.template` package, upgrade it separately: `npm install lodash.template@latest`.
3. Check for transitive dependencies that pin an older lodash version: run `npm ls lodash` (or `yarn why lodash`) and use `npm audit fix` or override the version in your package.json `overrides` / `resolutions` field if needed.
4. Commit the updated package-lock.json or yarn.lock and redeploy your application.
5. Avoid passing user-controlled input into the `variable` option of _.template() even on patched versions — treat it as an internal configuration value only.

Verification Steps

1. Run `npm ls lodash` and confirm all resolved versions are 4.17.21 or higher.
2. Run `npm audit` and verify CVE-2021-23337 no longer appears in the output.
3. If lodash is bundled into a frontend asset, inspect the built bundle: `grep -r '4\.17\.' dist/` and confirm the version string reflects 4.17.21+.

Code Examples (json)

// package.json — pinned to vulnerable version
{
  "dependencies": {
    "lodash": "^3.10.1"
  }
}

// package.json — upgraded to patched version
{
  "dependencies": {
    "lodash": "^4.17.21"
  }
}

// If a transitive dependency forces an older version, add an override:
{
  "overrides": {
    "lodash": "^4.17.21"
  }
}

Best Practices

• Never pass user-controlled data into the `variable` option of _.template() — restrict it to static, developer-defined strings.
• Run `npm audit` as part of your CI/CD pipeline to catch vulnerable dependencies before they reach production.
• Use a dependency management tool (e.g., Dependabot, Renovate) to receive automated pull requests when new security patches are released.
• Audit transitive dependencies regularly — many lodash vulnerabilities surface through indirect dependencies, not direct ones.

References

• github.com/advisories/GHSA-35jh-r3h4-6jhm
• github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
• github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a
• www.wiz.io/vulnerability-database/cve/cve-2021-23337