Arbitrary Code Execution in underscore

Description

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Recommendation

Update the underscore package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.3.2, < 1.12.1
• Patched version(s): 1.12.1

References

• GHSA-cf4h-3jhx-xvhq
• snyk.io
• www.npmjs.com
• lists.debian.org
• www.debian.org
• lists.apache.org
• www.tenable.com
• security.netapp.com
• lists.fedoraproject.org
• seclists.org
• CVE-2021-23358
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• [thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values - CVE-2021-21412
• Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader - CVE-2026-53597
• Remote code execution in Eclipse Theia - CVE-2021-34435
• Arbitrary code execution in djv - CVE-2020-28464

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

underscore