Low DLA-2613-1 1 CVE

underscore - security update

Published Mar 31, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 9	underscore	1.8.3~dfsg-1+deb9u1

Vulnerabilities 1

Low 3.3

CVE-2021-23358 Public exploit

Arbitrary Code Injection

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

js-jquery underscore underscore underscore Debian Ubuntu Azure Linux npm

Mar 29, 2021