Aikido explains why reachable CVEs aren't always exploitable, using lodash CVE-2021-23337 and CVE-2026-4800
Aikido published a vendor blog post arguing that SCA reachability analysis is not enough for prioritizing dependency vulnerabilities. Reachability shows whether code can execute a vulnerable function. Exploitability asks whether an attacker can satisfy the conditions the bug needs. The article uses lodash .template command injection (CVE-…