GitHub Advisoryadvisory · npm

GHSA-cf4h-3jhx-xvhq Arbitrary Code Execution in underscore

CRITICAL Published 2021-05-06 Modified 2025-11-04 Official page ↗
Aliases
CVE-2021-23358
Ecosystem
npm
Packages
underscore
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2021-03-31

Affected packages

• npm underscore: >= 1.3.2, < 1.12.1 → fixed in 1.12.1

Description

The package `underscore` from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Related

Alias · CVE (1)

  • CVE-2021-23358 The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References