Log in Start free

Vulnerability · Published Mar 29, 2021 · Assigned by snyk

CVE-2021-23358Arbitrary Code Injection

Low 3.3

In plain English

A low-severity security flaw in underscore. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.3Low
Exploit odds (30 days)4.2%top 9.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC

Official description

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12underscore1.9.1~dfsg-2DEBIAN-CVE-2021-23358
Debian:13underscore1.9.1~dfsg-2DEBIAN-CVE-2021-23358
Debian:14underscore1.9.1~dfsg-2DEBIAN-CVE-2021-23358
npmunderscore1.12.1GHSA-cf4h-3jhx-xvhq

Affected products (as reported)

VendorProductVersions
n/a underscore 1.13.0-0 – before unspecifiedunspecified – before 1.13.0-21.3.2 – before unspecifiedunspecified – before 1.12.1

References