CVE-2021-23337: 
JavaScript vulnerability analysis and mitigation

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function. The vulnerability was discovered on November 17, 2020 and publicly disclosed on February 15, 2021 with CVE identifier CVE-2021-23337. This vulnerability affects all versions of Lodash prior to version 4.17.21 (NVD, CVE).

The vulnerability exists in the template function of Lodash library. The CVSS v3.1 base score is 7.2 (High), with the following metrics: Attack Vector: Network, Attack Complexity: Low, Privileges Required: High, User Interaction: None, Scope: Unchanged, and Impact scores of High for Confidentiality, Integrity and Availability. A proof of concept exploit exists that demonstrates how the template function can be manipulated to achieve command injection (Snyk).

A successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The vulnerability allows attackers with sufficient privileges to execute arbitrary commands via the template function (NetApp).

The recommended mitigation is to upgrade Lodash to version 4.17.21 or higher. Multiple vendors have released patches and updates to address this vulnerability in their products that use Lodash (NetApp).