CVE-2021-23358
Arbitrary Code Injection
- State
- Published
- Severity
- 3.3 Low
- Published
- Mar 29, 2021
- Updated
- Nov 3, 2025
- Reserved
- Jan 8, 2021
Description
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.3 Low | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C | snyk |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
underscoren/a |
|
References
- https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1081503
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1081504
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBJASHKENAS-1081505
- https://github.com/jashkenas/underscore/blob/master/modules/template.js%23L71
- [debian-lts-announce] 20210331 [SECURITY] [DLA 2613-1] underscore security updatemailing-list
- DSA-4883vendor-advisory
- [cordova-issues] 20210414 [GitHub] [cordova-common] breautek closed issue #163: Security Vulnerability in underscore <= 1.12.0 CVE-2021-23358mailing-list
- [cordova-issues] 20210414 [GitHub] [cordova-common] breautek commented on issue #163: Security Vulnerability in underscore <= 1.12.0 CVE-2021-23358mailing-list
- [cordova-issues] 20210414 [GitHub] [cordova-common] RichardMcSorley opened a new issue #163: Security Vulnerability in underscore <= 1.12.0 CVE-2021-23358mailing-list
- [cordova-issues] 20210414 [GitHub] [cordova-common] RichardMcSorley commented on issue #163: Security Vulnerability in underscore <= 1.12.0 CVE-2021-23358mailing-list
- [cordova-issues] 20210414 [GitHub] [cordova-common] RichardMcSorley edited a comment on issue #163: Security Vulnerability in underscore <= 1.12.0 CVE-2021-23358mailing-list
- https://www.tenable.com/security/tns-2021-14
- FEDORA-2021-e49f936d9fvendor-advisory
- FEDORA-2021-f278299902vendor-advisory
- https://security.netapp.com/advisory/ntap-20240808-0003/
- http://seclists.org/fulldisclosure/2025/Apr/14
- https://security.netapp.com/advisory/ntap-20241108-0002/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.