Low USN-4913-1 1 CVE

underscore vulnerability

Published Apr 14, 2021 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Underscore incorrectly handled certain inputs.
An attacker could possibly use this issue to inject arbitrary code.

Fixed packages 4

Release	Package	Fixed in
Ubuntu · 16.04 LTS 16.04:LTS	underscore	1.7.0~dfsg-1ubuntu1.1
Ubuntu · 18.04 LTS 18.04:LTS	underscore	1.8.3~dfsg-1ubuntu0.1
Ubuntu · 20.04 LTS 20.04:LTS	underscore	1.9.1~dfsg-1ubuntu0.20.04.1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	underscore	1.4.4-2ubuntu1+esm1

Vulnerabilities 1

Low 3.3

CVE-2021-23358 Public exploit

Arbitrary Code Injection

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

js-jquery underscore underscore underscore Debian Ubuntu Azure Linux npm

Mar 29, 2021

References

report
https://ubuntu.com/security/CVE-2021-23358