Arbitrary code injection in underscore
Priority HIGH 67CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 5 fixed, 12 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.
Summary
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.042 91st percentileScored 2026-11-07
Fix Partial underscore: 1.13.0-2, 1.12.1underscore (npm): 1.12.1Red Hat: 7 advisoriesRed Hat: 5 fixed, 12 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | underscore | 1.13.0-0 and later; before 1.13.0-2; 1.3.2 and later; before 1.12.1 | 1.13.0-2, 1.12.1 | Patch available | CNA |
| — | underscore (npm) | 1.3.2 to before 1.12.1 | 1.12.1 | Patch available | GHSA-cf4h-3jhx-xvhq |
- underscore Vendor— Affected 1.13.0-0 and later; before 1.13.0-2; 1.3.2 and later; before 1.12.1 Fixed in 1.13.0-2, 1.12.1 Patch available CNA
- underscore (npm) Vendor— Affected 1.3.2 to before 1.12.1 Fixed in 1.12.1 Patch available GHSA-cf4h-3jhx-xvhq
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:underscorejs:underscore:*:*:*:*:*:node.js:*:* | 1.3.2 to before 1.12.1; 1.13.0-0 to before 1.13.0-2 | Vulnerable | Underscorejs |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* | up to 5.18.0 | Vulnerable | Tenable |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
- cpe:2.3:a:underscorejs:underscore:*:*:*:*:*:node.js:*:* Versions 1.3.2 to before 1.12.1; 1.13.0-0 to before 1.13.0-2 Vulnerable ·Underscorejs
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* Versions up to 5.18.0 Vulnerable ·Tenable
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA underscore Fixed in 1.13.0-2, 1.12.1
- Fix · GHSA-cf4h-3jhx-xvhq underscore (npm) Fixed in 1.12.1 Advisory →
Red Hat 7 advisories
- RHSA-2026:3406 Released 2026-02-26 · Red Hat rating ImportantNew container image: rhceph-9.0
- Red Hat Ceph Storage 9 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
- RHSA-2026:2769 Released 2026-02-17 · Red Hat rating ImportantRed Hat Ceph Storage 7.1 security and bug fix updates
- Red Hat Ceph Storage 7.1 Tools ceph-2:18.2.1-381.el8cp, ceph-2:18.2.1-381.el9cp, ceph-base-2:18.2.1-381.el8cp +47
- RHSA-2026:2737 Released 2026-02-16 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
Show 4 more Red Hat advisories
- RHSA-2022:6393 Released 2022-09-08 · Red Hat rating ImportantRHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.5.2.4-0.1.el8ev, ovirt-engine-backend-4.5.2.4-0.1.el8ev, ovirt-engine-dbscripts-4.5.2.4-0.1.el8ev +20
- RHSA-2021:2865 Released 2021-07-22 · Red Hat rating ModerateRHV Manager (ovirt-engine) security update [ovirt-4.4.7]
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-ui-extensions-1.2.7-1.el8ev
- RHSA-2021:1499 Released 2021-05-04 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.2.3 security and bug fix update
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 7 rhacm2/management-ingress-rhel7, rhacm2/memcached-exporter-rhel7, rhacm2/openshift-hive-rhel7 +2
- Red Hat Advanced Cluster Management for Kubernetes 2.2 for RHEL 8 rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle, rhacm2/acmesolver-rhel8 +47
- RHSA-2021:1448 Released 2021-04-28 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.0.10 security and bug fix updates
- Red Hat Advanced Cluster Management for Kubernetes 2.0 for RHEL 8 rhacm2/acm-operator-bundle
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 6 | Affected | No fix yet |
| Red Hat Ceph Storage 8 | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Container Storage 4 | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 | Fixed | RHSA-2021:2865, RHSA-2022:6393 |
| Red Hat Advanced Cluster Management for Kubernetes 2.0 for RHEL 8 | Fixed | RHSA-2021:1448 |
| Red Hat Ceph Storage 7.1 Tools | Fixed | RHSA-2026:2769 |
| Red Hat Ceph Storage 8 | Fixed | RHSA-2026:2737 |
| Red Hat Ceph Storage 9 | Fixed | RHSA-2026:3406 |
Not affected: 4 products
- RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
- Red Hat Ceph Storage 4
- Red Hat Ceph Storage 8
- Red Hat Ceph Storage 9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23358
- 2026-10-03 Alias added: GHSA-cf4h-3jhx-xvhq
- 2026-10-09 Affected versions changed · Red Hat
References
Advisory 6
Other 23
- https://github.com/jashkenas/underscore/blob/master/modules/template.js%23L71
- [cordova-issues] 20210414 [GitHub] [cordova-common] breautek closed issue #163: Security Vulnerability in underscore <= 1.12.0 CVE-2021-23358
- [cordova-issues] 20210414 [GitHub] [cordova-common] breautek commented on issue #163: Security Vulnerability in underscore <= 1.12.0 CVE-2021-23358
- [cordova-issues] 20210414 [GitHub] [cordova-common] RichardMcSorley opened a new issue #163: Security Vulnerability in underscore <= 1.12.0 CVE-2021-23358
- [cordova-issues] 20210414 [GitHub] [cordova-common] RichardMcSorley commented on issue #163: Security Vulnerability in underscore <= 1.12.0 CVE-2021-23358
- [cordova-issues] 20210414 [GitHub] [cordova-common] RichardMcSorley edited a comment on issue #163: Security Vulnerability in underscore <= 1.12.0 CVE-2021-23358
- https://github.com/jashkenas/underscore/pull/2917
- https://github.com/jashkenas/underscore/commit/4c73526d43838ad6ab43a6134728776632adeb66
- https://www.npmjs.com/package/underscore
- https://security.netapp.com/advisory/ntap-20241108-0002
- https://security.netapp.com/advisory/ntap-20240808-0003
- https://lists.fedoraproject.org/archives/list/[email protected]/message/FGEE7U4Z655A2MK5EW4UQQZ7B64XJWBV
- https://lists.fedoraproject.org/archives/list/[email protected]/message/EOKATXXETD2PF3OR36Q5PD2VSVAR6J5Z
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FGEE7U4Z655A2MK5EW4UQQZ7B64XJWBV
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKATXXETD2PF3OR36Q5PD2VSVAR6J5Z
- https://lists.apache.org/thread.html/re69ee408b3983b43e9c4a82a9a17cbbf8681bb91a4b61b46f365aeaf@%3Cissues.cordova.apache.org%3E
- https://lists.apache.org/thread.html/rbc84926bacd377503a3f5c37b923c1931f9d343754488d94e6f08039@%3Cissues.cordova.apache.org%3E
- https://lists.apache.org/thread.html/raae088abdfa4fbd84e1d19d7a7ffe52bf8e426b83e6599ea9a734dba@%3Cissues.cordova.apache.org%3E
- https://lists.apache.org/thread.html/r770f910653772317b117ab4472b0a32c266ee4abbafda28b8a6f9306@%3Cissues.cordova.apache.org%3E
- https://lists.apache.org/thread.html/r5df90c46f7000c4aab246e947f62361ecfb849c5a553dcdb0ef545e1@%3Cissues.cordova.apache.org%3E
- https://github.com/jashkenas/underscore/releases/tag/1.12.1
- https://github.com/jashkenas/underscore
- http://seclists.org/fulldisclosure/2025/Apr/14
Sources
- CVE-2021-23358 · CVE Program
- CVE-2021-23358 · NVD
- FIRST EPSS
- GHSA-cf4h-3jhx-xvhq · GitHub Advisory Database · CC BY 4.0
- CVE-2021-23358 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences