Fix CVE–2021–23337

[debricked-staging]

CVE–2021–23337

Vulnerable dependency:     lodash (npm)    4.17.10

Vulnerable dependency:     lodash (Yarn)    4.17.10

Vulnerability details

Description

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

GitHub

Command Injection in lodash

lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

NVD

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

CVSS details - 7.2

 

CVSS3 metrics
Attack Vector	Network
Attack Complexity	Low
Privileges Required	High
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

References

    Command Injection in lodash · CVE-2021-23337 · GitHub Advisory Database · GitHub
    NVD - CVE-2021-23337
    MISC
    February 2021 Lodash Vulnerabilities in NetApp Products | NetApp Product Security
    lodash/lodash.js at ddfd9b11a0126db2302cb70ec9973b66baec0975 · lodash/lodash · GitHub
    Prevent command injection through _.template's variable option · lodash/lodash@3469357 · GitHub
    Oracle Critical Patch Update Advisory - July 2021
    Oracle Critical Patch Update Advisory - October 2021
    Oracle Critical Patch Update Advisory - January 2022

 

Related information

📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more about the CVE