Loading story…
CVE-2021-23337 is a high-severity command-injection flaw in Lodash versions before 4.17.21. Applications that pass attacker-controlled input to the variable option of _.template may allow that input to alter the generated function definition and execute arbitrary JavaScript commands, potentially compromising confidentiality, integrity, and availability. The vulnerability is rated CVSS 7.2.
Lodash remediated the issue by validating the template variable option and rejecting values containing function-altering characters, including parentheses, commas, equals signs, braces, brackets, slashes, and whitespace. The project added a regression test covering an attempted console.log(process.env) payload; organizations using affected Lodash releases should upgrade to 4.17.21 or later and review uses of _.template that incorporate untrusted values.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2021-23337 was updated.
CVE-2021-23337 was published for a high-severity command-injection vulnerability in Lodash versions before 4.17.21, reachable through the template function.
The Lodash project added validation that rejects forbidden characters in _.template's variable option, preventing values from altering generated function parameters. It also added a regression test using a payload intended to execute console.log(process.env).
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cve.org
Open sourcegithub.com
Open sourcesnyk.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Belgium’s Centre for Cybersecurity has warned of a **critical remote code execution** flaw in the LiquidJS template engine, and public reporting identifies the issue as `CVE-2026-45618` with a **CVSS score of 10.0**. The vulnerability affects LiquidJS versions **10.25.7 and earlier** and stems from improper input validation during filter evaluation, which can let an attacker reach the internal execution context, manipulate internal functions, and obtain access to the JavaScript `Function` constructor. Successful exploitation could allow arbitrary command execution and access to sensitive files, creating a path to full system compromise in applications that process untrusted templates. LiquidJS is widely used to bring Shopify, Jekyll, and GitHub Pages-style templating to Node.js environments and is reported to have more than **7.3 million monthly downloads**, expanding the downstream exposure. Maintainers have addressed the flaw in **LiquidJS 10.27.0**, and defenders are being urged to inventory affected systems and upgrade immediately.
Jun 29, 2026
A critical **server-side template injection** flaw tracked as `CVE-2026-54390` affects **JTL Shop** versions **5.2.0 through 5.7.1**, where unsanitized user input is passed to the **Smarty** template engine. The vulnerability allows **unauthenticated remote attackers** to inject malicious template syntax and access sensitive server-side information, including **database credentials** and **encryption keys**. On **JTL Shop 5.4.0 through 5.7.1**, the flaw can be escalated to **remote code execution** by abusing registered Smarty modifiers such as `unserialize` and `file_get_contents` to write a **webshell** into the web root and run arbitrary commands as the web server user. The issue has been rated **critical** with **CVSS 3.1 9.8** and **CVSS 4.0 9.3**, and affected organizations are advised to upgrade to **JTL Shop 5.7.2 or later** and ensure user input reaching the template engine is properly sanitized.
Jun 29, 2026
A critical flaw tracked as **`CVE-2026-71320`** allows remote code execution in the Nuxt framework by abusing server island props passed to the ` /__nuxt_island/ ` endpoint when **`vue.runtimeCompiler: true`** is enabled. The bug affects **Nuxt 3.4.0 through before 3.21.10** and **Nuxt 4.0.0 through before 4.5.1**, where attacker-controlled properties from query strings or request bodies could reach the server-side rendering pipeline and inject a dangerous `template` key into dynamic Vue components, leading to template execution inside the Nitro process. The issue is classified under **`CWE-94`** and **`CWE-74`** and carries a high-impact CVSS vector of **`AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`**. Nuxt has released fixes in **3.21.10** and **4.5.1** that add deep validation for unsafe island props and reject malicious requests with **HTTP 400** when the runtime compiler is active. The patch introduces a traversal check for the `template` key before props are forwarded into SSR, closing the documented attack path involving dynamic components such as ` <component :is> `. Researchers noted a residual theoretical concern that the validation relies on `Object.keys()` and could be bypassed in a separate prototype-pollution scenario, but the primary mitigation is available now and defenders are also advised to disable **`vue.runtimeCompiler`** in `nuxt.config.ts` where it is not required.
Aug 6, 2026