lodash template command injection

Summary

Command injection through lodash's template function when untrusted input reaches the template options. Impact depends on how the application uses the library.

Component: lodash. Disclosed: 15 February 2021. Last verified: 22 October 2026, 16:45 UTC.

Affected versions

Version ranges preserve the source wording. A distribution package may contain a backport without changing this string. GitHub Advisory Database

Fixed versions

Update to lodash 4.17.21 or later. Check the separate lodash.template and lodash-template packages, which the advisory lists with no patched version. GitHub Advisory Database

Conditions and scope

These are the conditions named by the sources. They are not a score and not a prediction.

• The application passes untrusted input into lodash template compilation, particularly template options.
• A dependency tree that includes lodash does not by itself prove the vulnerable code path is reachable.
• This is an npm package issue, not a Node.js core issue.

Exploitation status

No public confirmation of exploitation was found in the sources checked. Exploitability depends on whether untrusted input reaches the template function.

Severity and scoring

Scores are listed with their version and assessor. Different CVSS versions, and different assessors, are not averaged. The presence of a high score does not establish exploitation, and a lower score does not make a memory-safety defect harmless.

Why a package advisory needs reachability

lodash is embedded in an enormous number of dependency trees. A scanner can report the package present without showing whether the vulnerable template path is reachable from untrusted input. That difference matters when prioritising work.

The advisory's conditions are specific: command injection through the template function. Applications that never compile templates from untrusted data have a different exposure profile from applications that do. This is a general lesson, not a claim that any particular site is safe.

Fix

Upgrade lodash to 4.17.21 or later. Because lockfiles can keep multiple copies, verify the resolved version in the built artefact, not only in package.json. The advisory also lists standalone template packages that need separate review.

This is an npm dependency entry. It is deliberately not described as a Node.js core vulnerability.

What to do

• Verify the serving runtime and the installed fix — useful for any runtime update, not only PHP.
• Interim controls and their limits — how to buy time without claiming a fix.
• Read the advisory labels correctly — CVSS versions, KEV, PoC and exploitation.

Sources

Last verified 22 October 2026, 16:45 UTC. A statement that no evidence was found in checked sources is not a statement that an event never occurred.