CVE-2021-23358: Debian Linux

High severity, CVSS 7.2. EPSS: 4.1% chance of exploitation in the next 30 days.

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Tenable Tenable.sc: up to and including 5.18.0
• Underscorejs Underscore: from 1.3.2, before 1.12.1 (fixed in 1.12.1); from 1.13.0-0, before 1.13.0-2 (fixed in 1.13.0-2)

Published 2021-03-29. Last modified 2026-06-17.