/
← Voltar ao feed
low

Aikido explains why reachable CVEs aren't always exploitable, using lodash CVE-2021-23337 and CVE-2026-4800

1 fonte(s) · 1 atualização(ões) · publicado 17/10/2026 19:19 · coletado há 8 horas

Aikido published a vendor blog post arguing that SCA reachability analysis is not enough for prioritizing dependency vulnerabilities. Reachability shows whether code can execute a vulnerable function. Exploitability asks whether an attacker can satisfy the conditions the bug needs. The article uses lodash _.template command injection (CVE-2021-23337, CVSS 7.2, EPSS about 21%, not on CISA KEV) to show how three apps depending on the same vulnerable version warrant different priorities. It also notes that the 2021 fix missed the options.imports key names path, which became CVE-2026-4800 and was fixed in lodash 4.18.0. The post promotes Aikido's CVE Exploitability Analysis feature and is not reporting an incident or new in-the-wild exploitation.

Technical Details

  • CVE-2021-23337 is a command injection in lodash _.template affecting versions before 4.17.21. The variable option is inserted into generated function source without sanitization, so attacker-controlled input can run code when the template compiles.
  • The article's example apps: App A never calls _.template (not reachable). App B calls it with hardcoded template and options (reachable, not exploitable). App C spreads request data into the options (reachable and exploitable).
  • The 2021 fix validated the variable option but not options.imports key names, which also feed the Function() constructor. This second path is CVE-2026-4800, fixed in lodash 4.18.0.
  • Prototype pollution elsewhere in an app could make the imports path attacker-controllable, because _.template copies inherited properties into imports. An exploitability verdict can therefore change as code, inputs, configuration or base images change.
  • CISA VEX status justifications distinguish "vulnerable code not in execute path" (reachability) from "vulnerable code cannot be controlled by adversary" (exploitability).

Remediation

  • Upgrade lodash to 4.17.21 or later to address CVE-2021-23337, and to 4.18.0 to address CVE-2026-4800.
  • Do not pass untrusted input into _.template options.
  • Combine reachability with exploitability analysis and re-evaluate verdicts whenever code, inputs, configuration or container images change.

Linha do tempo

  1. aikido.dev ↗ · pub. 17/10/2026 19:19 · coletado 20/10 16:30 primeiro registro

    Aikido explains why reachable CVEs aren't always exploitable, using lodash CVE-2021-23337 and CVE-2026-4800

    ler a análise desta fonte

    Aikido published a vendor blog post arguing that SCA reachability analysis is not enough for prioritizing dependency vulnerabilities. Reachability shows whether code can execute a vulnerable function. Exploitability asks whether an attacker can satisfy the conditions the bug needs. The article uses lodash _.template command injection (CVE-2021-23337, CVSS 7.2, EPSS about 21%, not on CISA KEV) to show how three apps depending on the same vulnerable version warrant different priorities. It also notes that the 2021 fix missed the options.imports key names path, which became CVE-2026-4800 and was fixed in lodash 4.18.0. The post promotes Aikido's CVE Exploitability Analysis feature and is not reporting an incident or new in-the-wild exploitation.

    Technical Details

    • CVE-2021-23337 is a command injection in lodash _.template affecting versions before 4.17.21. The variable option is inserted into generated function source without sanitization, so attacker-controlled input can run code when the template compiles.
    • The article's example apps: App A never calls _.template (not reachable). App B calls it with hardcoded template and options (reachable, not exploitable). App C spreads request data into the options (reachable and exploitable).
    • The 2021 fix validated the variable option but not options.imports key names, which also feed the Function() constructor. This second path is CVE-2026-4800, fixed in lodash 4.18.0.
    • Prototype pollution elsewhere in an app could make the imports path attacker-controllable, because _.template copies inherited properties into imports. An exploitability verdict can therefore change as code, inputs, configuration or base images change.
    • CISA VEX status justifications distinguish "vulnerable code not in execute path" (reachability) from "vulnerable code cannot be controlled by adversary" (exploitability).

    Remediation

    • Upgrade lodash to 4.17.21 or later to address CVE-2021-23337, and to 4.18.0 to address CVE-2026-4800.
    • Do not pass untrusted input into _.template options.
    • Combine reachability with exploitability analysis and re-evaluate verdicts whenever code, inputs, configuration or container images change.