CVE-2021-23358

Katalog CVE

CVSS 7.2 · High EPSS 4,1%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada underscorejs underscore, debian linux +2 lainnya. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Rincian

Terbit di NVD

29 Maret 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

4,1% peluang dieksploitasi; lebih tinggi dari 90,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.debian.org/debian-lts-announce/2021/03/msg00038.html mailing list · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1081504 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBJASHKENAS-1081505 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1081503 exploit · advisory pihak ketiga
• https://snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984 exploit · advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4883 advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-14 advisory pihak ketiga
• https://github.com/jashkenas/underscore/blob/master/modules/template.js%23L71 broken link
• https://lists.apache.org/thread.html/r5df90c46f7000c4aab246e947f62361ecfb849c5a553dcdb0ef545e1%40%3Cissues.cor...
• https://lists.apache.org/thread.html/r770f910653772317b117ab4472b0a32c266ee4abbafda28b8a6f9306%40%3Cissues.cor...
• https://lists.apache.org/thread.html/raae088abdfa4fbd84e1d19d7a7ffe52bf8e426b83e6599ea9a734dba%40%3Cissues.cor...
• https://lists.apache.org/thread.html/rbc84926bacd377503a3f5c37b923c1931f9d343754488d94e6f08039%40%3Cissues.cor...
• https://lists.apache.org/thread.html/re69ee408b3983b43e9c4a82a9a17cbbf8681bb91a4b61b46f365aeaf%40%3Cissues.cor...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKATXXETD2PF...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGEE7U4Z655A2...
• http://seclists.org/fulldisclosure/2025/Apr/14
• https://security.netapp.com/advisory/ntap-20240808-0003/
• https://security.netapp.com/advisory/ntap-20241108-0002/