CVE-2021-23358

Published: Mar 29, 2021Modified: Jun 17, 2026

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: NVD

Description

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Affected (7)

Products: Underscorejs: Underscore · Debian: Debian Linux · Tenable: Tenable.sc · +1 more

Show all products

Underscorejs: Underscore · Debian: Debian Linux · Tenable: Tenable.sc · Fedoraproject: Fedora

1 product

1 product

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Underscorejs Underscore	From 1.13.0-0 to 1.13.0-2
Underscorejs Underscore	From 1.3.2 to 1.12.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Tenable Tenable.sc	Up to 5.18.0

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 33
Fedoraproject Fedora	Version 34

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (33)

https://github.com/jashkenas/underscore/blob/master/modules/template.js%23L71

Source: report@snyk.io

Broken Link

https://lists.apache.org/thread.html/r5df90c46f7000c4aab246e947f62361ecfb849c5a553dcdb0ef545e1%40%3Cissues.cordova.apache.org%3E

Source: report@snyk.io

https://lists.apache.org/thread.html/r770f910653772317b117ab4472b0a32c266ee4abbafda28b8a6f9306%40%3Cissues.cordova.apache.org%3E

Source: report@snyk.io

https://lists.apache.org/thread.html/raae088abdfa4fbd84e1d19d7a7ffe52bf8e426b83e6599ea9a734dba%40%3Cissues.cordova.apache.org%3E

Source: report@snyk.io

https://lists.apache.org/thread.html/rbc84926bacd377503a3f5c37b923c1931f9d343754488d94e6f08039%40%3Cissues.cordova.apache.org%3E

Source: report@snyk.io

https://lists.apache.org/thread.html/re69ee408b3983b43e9c4a82a9a17cbbf8681bb91a4b61b46f365aeaf%40%3Cissues.cordova.apache.org%3E

Source: report@snyk.io

https://lists.debian.org/debian-lts-announce/2021/03/msg00038.html

Source: report@snyk.io

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKATXXETD2PF3OR36Q5PD2VSVAR6J5Z/

Source: report@snyk.io

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGEE7U4Z655A2MK5EW4UQQZ7B64XJWBV/

Source: report@snyk.io

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1081504

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBJASHKENAS-1081505

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1081503

Source: report@snyk.io

ExploitThird Party Advisory

https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984

Source: report@snyk.io

ExploitThird Party Advisory

https://www.debian.org/security/2021/dsa-4883

Source: report@snyk.io

Third Party Advisory

https://www.tenable.com/security/tns-2021-14

Source: report@snyk.io

Third Party Advisory

http://seclists.org/fulldisclosure/2025/Apr/14