vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2021-23358

Arbitrary Code Injection

HIGH
7.2
CVSS Score
Published: March 29, 2021 at 01:15 PM UTC
Updated: June 17, 2026 at 03:38 AM UTC
4 products affected across 4 vendorsDebian LinuxFedoraTenable.Sc

Using underscore by N/A?

Get instant alerts when new vulnerabilities affect underscore - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.2
Exploit prediction
EPSS 4%
SSVC
PoC

Description

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux· Debiandrupal
95%
10.09.0
Fedora· Fedora Projectrpm
95%
3334
Tenable.Sc· Tenabledrupal
95%
v ≤ 5.18.0
Underscore· Underscorejsnpm
95%
v ≥ 1.13.0-0v ≥ 1.3.2v < 1.12.1v < 1.13.0-21.13.0-0 ≤ v < 1.13.0-21.3.2 ≤ v < 1.12.11.13.0-01.3.2
Affected range stops below 1.12.1, so it looks safe — our inference, not a vendor statement
Affected range stops below 1.13.0-2, so it looks safe — our inference, not a vendor statement

References (18)

x_refsource_MISCBroken Link
Source: [email protected]
https://github.com/jashkenas/underscore/blob/master/modules/template.js%23L71
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r5df90c46f7000c4aab246e947f62361ecfb849c5a553dcdb0ef545e1%40%3Cissues.cordova.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/r770f910653772317b117ab4472b0a32c266ee4abbafda28b8a6f9306%40%3Cissues.cordova.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/raae088abdfa4fbd84e1d19d7a7ffe52bf8e426b83e6599ea9a734dba%40%3Cissues.cordova.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/rbc84926bacd377503a3f5c37b923c1931f9d343754488d94e6f08039%40%3Cissues.cordova.apache.org%3E
Mailing Listx_refsource_MLIST
Source: [email protected]
https://lists.apache.org/thread.html/re69ee408b3983b43e9c4a82a9a17cbbf8681bb91a4b61b46f365aeaf%40%3Cissues.cordova.apache.org%3E
Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2021/03/msg00038.html
Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKATXXETD2PF3OR36Q5PD2VSVAR6J5Z/

SSVC — Action Prioritization

SSVCPoCNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.2HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-94

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card