Skip to content

Update vulnerable Underscore.js 1.3.3  #1345

@alan-null

Description

@alan-null

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

srouce: https://nvd.nist.gov/vuln/detail/CVE-2021-23358

p.s
I did quick tests and it appears that replacing it with Underscore.js 1.13.6 doesn't seem to cause any damage.

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

Relationships

None yet

Development

No branches or pull requests

Issue actions