Underscorejs

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

Underscorejs records in CISA KEV

No Underscorejs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Underscore 2 records HIGH

Records

2 records in Underscore · all components

TI-2021-06054 CVE-2021-23358 · GHSA-cf4h-3jhx-xvhq

Arbitrary code injection in underscore

HIGH 67

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.042 Published 2021-03-29 Partial fix · 1.13.0-2, 1.12.1 CWE-94

TI-2026-21987 CVE-2026-27601 · GHSA-qpx9-hpmf-5gmw

Underscore.js has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

LOW 38

Underscore.js is a utility-belt library for JavaScript.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.01063 Published 2026-03-03 Partial fix · 1.13.8 CWE-770

Open these records in search →

Critical	0
High	2
Medium	0
Low	0
No CVSS	0