Homepage

Arbitrary Code Injection The advisory has been revoked - it doesn't affect any version of package es-toolkit  (opens in a new tab)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Arbitrary Code Injection vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JS-ESTOOLKIT-15441005
  • published9 Mar 2026
  • disclosed8 Mar 2026
  • creditMakoto Maeda
Report a new vulnerability Found a mistake?

Introduced: 8 Mar 2026

New CVE NOT AVAILABLE CWE-94  (opens in a new tab)
First added by Snyk

How to fix?

There is no fixed version for es-toolkit.

Amendment

This was deemed not a vulnerability.

Overview

es-toolkit is an A state-of-the-art, high-performance JavaScript utility library with a small bundle size and strong type annotations.

Affected versions of this package are vulnerable to Arbitrary Code Injection. The template() function in es-toolkit (versions ≤ 1.45.1) is vulnerable to Code Injection via the options.variable parameter. An attacker who controls the options.variable parameter can inject arbitrary JavaScript code into the new Function() constructor, enabling arbitrary command execution in the context of the server process. This vulnerability is a reproduction of CVE-2021-23337 in lodash.