Low DSA-4883-1 1 CVE

underscore - security update

Published Apr 1, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 10	underscore	1.9.1~dfsg-1+deb10u1

Vulnerabilities 1

Low 3.3

CVE-2021-23358 Public exploit

Arbitrary Code Injection

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

js-jquery underscore underscore underscore Debian Ubuntu Azure Linux npm

Mar 29, 2021