High
Security advisory
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-23358
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:11 UTC · Revision 1
Source evidence
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
osv:CVE-2021-23358
Complete source record
{
"id": "dd9e9fc5f9fbb40b0c1bd8144b3b86c9ac249d02f529e16be2282d80b178540c",
"url": "https://osv.dev/vulnerability/CVE-2021-23358",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-23358",
"summary": "The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.",
"evidence": "osv:CVE-2021-23358",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-23358",
"aliases": [
"CVE-2021-23358",
"GHSA-cf4h-3jhx-xvhq"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jashkenas/underscore",
"type": "GIT",
"events": [
{
"introduced": "e80bbe6d03193743a8d3e3d2d8bb365451382de8"
},
{
"fixed": "c627e3847981e0f573f43d6ef6c9c10ab5891d50"
},
{
"introduced": "645f8fa1d5d33711e2899b966ecc5c759aab87df"
},
{
"fixed": "163f032bddbc657f1d2575ff030001b0a5062cd3"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:underscorejs:underscore:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "1.3.2"
},
{
"fixed": "1.12.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:underscorejs:underscore:*:*:*:*:*:node.js:*:*",
"range": [
{
"introduced": "1.13.0-0"
},
{
"fixed": "1.13.0-2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"1.13.0-1",
"1.13.0-0",
"1.12.0",
"1.11.0",
"1.10.2",
"1.10.1",
"1.10.0",
"1.9.2",
"1.9.1",
"1.9.0",
"1.8.3",
"1.6.0",
"1.5.2",
"1.5.1",
"1.5.0",
"1.4.4",
"1.4.3",
"1.4.2",
"1.4.1",
"1.4.0",
"1.3.3",
"1.3.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23358.json"
}
}
],
"modified": "2026-10-24T10:30:25.618641014Z",
"provider": "osv",
"references": [
"https://github.com/jashkenas/underscore/blob/master/modules/template.js%23L71",
"https://lists.apache.org/thread.html/r5df90c46f7000c4aab246e947f62361ecfb849c5a553dcdb0ef545e1%40%3Cissues.cordova.apache.org%3E",
"https://lists.apache.org/thread.html/r770f910653772317b117ab4472b0a32c266ee4abbafda28b8a6f9306%40%3Cissues.cordova.apache.org%3E",
"https://lists.apache.org/thread.html/raae088abdfa4fbd84e1d19d7a7ffe52bf8e426b83e6599ea9a734dba%40%3Cissues.cordova.apache.org%3E",
"https://lists.apache.org/thread.html/rbc84926bacd377503a3f5c37b923c1931f9d343754488d94e6f08039%40%3Cissues.cordova.apache.org%3E",
"https://lists.apache.org/thread.html/re69ee408b3983b43e9c4a82a9a17cbbf8681bb91a4b61b46f365aeaf%40%3Cissues.cordova.apache.org%3E",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKATXXETD2PF3OR36Q5PD2VSVAR6J5Z/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGEE7U4Z655A2MK5EW4UQQZ7B64XJWBV/",
"https://lists.debian.org/debian-lts-announce/2021/03/msg00038.html",
"https://security.netapp.com/advisory/ntap-20240808-0003/",
"https://security.netapp.com/advisory/ntap-20241108-0002/",
"https://www.debian.org/security/2021/dsa-4883",
"https://www.tenable.com/security/tns-2021-14",
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1081504",
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBJASHKENAS-1081505",
"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1081503",
"https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*"
],
"vendor_product": "tenable:tenable.sc",
"extracted_events": [
{
"range": [
{
"last_affected": "5.18.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "33"
},
{
"last_affected": "33"
},
{
"introduced": "34"
},
{
"last_affected": "34"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-23358",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 431400,
"published_at": "2021-03-29T14:15:18.047+00:00"
}