~ / search / GHSA-cf4h-3jhx-xvhq

GHSA-cf4h-3jhx-xvhq

Arbitrary Code Execution in underscore

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-23358

Packages

EcosystemPackageAffectedFixed in
npm underscore >= 1.3.2, < 1.12.1 1.12.1

Details

As written in the advisory (Markdown source, shown as plain text).

The package `underscore` from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

References

External links from the advisory. They lead to third-party sites.