CVE-2021-23358
Arbitrary Code Injection
3.3 LowPublic exploitFix available
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
4.20%Up 2.5 points since Apr 14, 2021
What each source reports
CVE List Score used
Arbitrary Code Injection
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
- Record
CVE-2021-23358- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C - Updated
- 2026-11-02
EUVDEUVD-2021-1042
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
- Record
EUVD-2021-1042- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cf4h-3jhx-xvhq
Arbitrary Code Execution in underscore
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
- Record
GHSA-cf4h-3jhx-xvhq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
- Record
CVE-2021-23358- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVAZL-45222
CVE-2021-23358 affecting package js-jquery 3.5.0-4
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
- Record
AZL-45222- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSV
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
- Record
CVE-2021-23358- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 16 moreShow less
OSVDEBIAN-CVE-2021-23358
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
- Record
DEBIAN-CVE-2021-23358- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-cf4h-3jhx-xvhq
Arbitrary Code Execution in underscore
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
- Record
GHSA-cf4h-3jhx-xvhq- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVOESA-2021-1174
nodejs-underscore security update
Underscore.js is a utility-belt library for JavaScript that provides support for the usual functional suspects (each, map, reduce, filter...) without extending any core JavaScript objects.
Security Fix(es):
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.(CVE-2021-23358)
- Record
OESA-2021-1174- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:2865
Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.7]
- Record
RHSA-2021:2865- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2022:6393
Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update
- Record
RHSA-2022:6393- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:2769
Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security and bug fix updates
- Record
RHSA-2026:2769- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-23358
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
- Record
UBUNTU-CVE-2021-23358- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1775003188 No score
TuxCare security update for underscore (1 CVE)
TuxCare rebuilt underscore to address 1 CVE. Fixed in 1.6.0-tuxcare.1.
- Record
CLSA-2026-1775003188- Updated
- 2026-11-02
OSVCLSA-2026-1775003190 No score
TuxCare security update for underscore (1 CVE)
TuxCare rebuilt underscore to address 1 CVE. Fixed in 1.4.4-tuxcare.1.
- Record
CLSA-2026-1775003190- Updated
- 2026-11-02
OSVCLSA-2026-1775003192 No score
TuxCare security update for underscore (2 CVEs)
TuxCare rebuilt underscore to address 2 CVEs. Fixed in 1.7.0-tuxcare.1.
- Record
CLSA-2026-1775003192- Updated
- 2026-11-02
OSVCLSA-2026-1792767425 No score
TuxCare security update for underscore (2 CVEs)
TuxCare rebuilt underscore to address 2 CVEs. Fixed in 1.9.1-tuxcare.1.
- Record
CLSA-2026-1792767425- Updated
- 2026-11-02
OSVMGASA-2021-0269 No score
Updated puddletag packages fix security vulnerability
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injectio via the template function, particularly when a variable property is passed as an argument as it is not sanitized (CVE-2021-23358)
- Record
MGASA-2021-0269- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0601-1 No score
Security update for nodejs-underscore
This update for nodejs-underscore fixes the following issues:
Update version to 1.13.1
- Fix security issue (boo#1184800, CVE-2021-23358)
- Fix bugs
- Many new features
- Record
openSUSE-SU-2021:0601-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11095-1 No score
nodejs-underscore-1.13.1-1.3 on GA media
These are all security issues fixed in the nodejs-underscore-1.13.1-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11095-1- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2021-23358 No score
CVE-2021-23358 in underscore - Patched by Root
Root has patched CVE-2021-23358 in the underscore package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2021-23358- Updated
- 2026-11-02
OSVUSN-4913-1 No score
underscore vulnerability
It was discovered that Underscore incorrectly handled certain inputs. An attacker could possibly use this issue to inject arbitrary code.
- Record
USN-4913-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
underscorenpm |
1.3.2 up to 1.12.1 | 1.12.1 |
js-jqueryAzure Linux:3 |
through 3.5.0-4 | None known |
underscoreTuxCare:npm |
1.6.0-tuxcare.0 up to 1.6.0-tuxcare.1, plus listed versions 1.6.0 |
1.6.0-tuxcare.1 |
underscoreTuxCare:npm |
1.4.4-tuxcare.0 up to 1.4.4-tuxcare.1, plus listed versions 1.4.4 |
1.4.4-tuxcare.1 |
underscoreTuxCare:npm From an advisory covering 2 CVEs |
1.7.0-tuxcare.0 up to 1.7.0-tuxcare.1, plus listed versions 1.7.0 |
1.7.0-tuxcare.1 |
underscoreTuxCare:npm From an advisory covering 2 CVEs |
1.9.1-tuxcare.0 up to 1.9.1-tuxcare.1, plus listed versions 1.9.1 |
1.9.1-tuxcare.1 |
underscoreDebian:12 |
before 1.9.1~dfsg-2 | 1.9.1~dfsg-2 |
underscoreDebian:13 |
before 1.9.1~dfsg-2 | 1.9.1~dfsg-2 |
underscoreDebian:14 |
before 1.9.1~dfsg-2 | 1.9.1~dfsg-2 |
underscoreDebian:9 |
before 1.8.3~dfsg-1+deb9u1, plus listed versions 1.8.3~dfsg-1 |
1.8.3~dfsg-1+deb9u1 |
Show 145 moreShow less
| Package | Affected | Fixed |
|---|---|---|
underscoreDebian:10 |
before 1.9.1~dfsg-1+deb10u1, plus listed versions 1.9.1~dfsg-1 |
1.9.1~dfsg-1+deb10u1 |
puddletagMageia:8 |
before 2.0.2-0.git20210523.1.mga8 | 2.0.2-0.git20210523.1.mga8 |
nodejs-underscoreopenEuler:20.03-LTS-SP1 |
before 1.9.1-2.oe1 | 1.9.1-2.oe1 |
ovirt-engine-ui-extensionsRed Hat:rhev_manager:4.4:el8 From an advisory covering 4 CVEs |
before 0:1.2.7-1.el8ev | 0:1.2.7-1.el8ev |
ovirt-engineRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-backendRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-dbscriptsRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-health-check-bundlerRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-restapiRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-setupRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-setup-baseRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-setup-plugin-cinderlibRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-setup-plugin-imageioRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-setup-plugin-ovirt-engineRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-setup-plugin-ovirt-engine-commonRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-setup-plugin-vmconsole-proxy-helperRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-setup-plugin-websocket-proxyRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-toolsRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-tools-backupRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-vmconsole-proxy-helperRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-webadmin-portalRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-engine-websocket-proxyRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
python3-ovirt-engine-libRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
rhvmRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.5.2.4-0.1.el8ev | 0:4.5.2.4-0.1.el8ev |
ovirt-web-uiRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:1.9.1-1.el8ev | 0:1.9.1-1.el8ev |
ovirt-log-collectorRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:4.4.7-2.el8ev | 0:4.4.7-2.el8ev |
ovirt-engine-ui-extensionsRed Hat:rhev_manager:4.4:el8 From an advisory covering 6 CVEs |
before 0:1.3.5-1.el8ev | 0:1.3.5-1.el8ev |
cephRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-baseRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-base-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-commonRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-common-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-debugsourceRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-exporter-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-fuseRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-fuse-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-immutable-object-cacheRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-immutable-object-cache-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-mds-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-mgr-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-mibRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-mon-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-osd-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-radosgw-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-resource-agentsRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-selinuxRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
ceph-test-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
cephfs-mirror-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
cephfs-topRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
libcephfs-develRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
libcephfs2Red Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
libcephfs2-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
libcephsqlite-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
librados-develRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
librados-devel-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
librados2Red Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
librados2-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
libradospp-develRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
libradosstriper1Red Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
libradosstriper1-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
librbd-develRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
librbd1Red Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
librbd1-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
librgw-develRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
librgw2Red Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
librgw2-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
python3-ceph-argparseRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
python3-ceph-commonRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
python3-cephfsRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
python3-cephfs-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
python3-radosRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
python3-rados-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
python3-rbdRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
python3-rbd-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
python3-rgwRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
python3-rgw-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
rbd-fuse-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
rbd-mirror-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
rbd-nbdRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
rbd-nbd-debuginfoRed Hat:ceph_storage:7.1::el8 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el8cp | 2:18.2.1-381.el8cp |
cephRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-baseRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-base-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-commonRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-common-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-debugsourceRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-exporter-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-fuseRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-fuse-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-immutable-object-cacheRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-immutable-object-cache-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-mds-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-mgr-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-mibRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-mon-client-nvmeof-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-mon-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-osd-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-radosgw-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-resource-agentsRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-selinuxRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
ceph-test-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
cephadmRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
cephfs-mirror-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
cephfs-topRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
libcephfs-develRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
libcephfs2Red Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
libcephfs2-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
libcephsqlite-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
librados-develRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
librados-devel-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
librados2Red Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
librados2-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
libradospp-develRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
libradosstriper1Red Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
libradosstriper1-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
librbd-develRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
librbd1Red Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
librbd1-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
librgw-develRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
librgw2Red Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
librgw2-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
python3-ceph-argparseRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
python3-ceph-commonRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
python3-cephfsRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
python3-cephfs-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
python3-radosRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
python3-rados-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
python3-rbdRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
python3-rbd-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
python3-rgwRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
python3-rgw-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
rbd-fuse-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
rbd-mirror-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
rbd-nbdRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
rbd-nbd-debuginfoRed Hat:ceph_storage:7.1::el9 From an advisory covering 11 CVEs |
before 2:18.2.1-381.el9cp | 2:18.2.1-381.el9cp |
underscoreRoot:npm |
before 1.8.3-aikido.2 | 1.8.3-aikido.21.7.0-aikido.21.8.3-aikido.31.12.1-aikido.1 |
@rootio/underscoreRoot:npm |
before 1.7.0-root.io.1 | 1.7.0-root.io.11.8.3-root.io.11.8.3-root.io.21.7.0-root.io.21.8.3-root.io.31.12.1-root.io.1 |
underscoreUbuntu:Pro:14.04:LTS |
before 1.4.4-2ubuntu1+esm1, plus listed versions 1.4.4-2ubuntu1 |
1.4.4-2ubuntu1+esm1 |
underscoreUbuntu:16.04:LTS |
before 1.7.0~dfsg-1ubuntu1.1, plus listed versions 1.7.0~dfsg-1ubuntu1 |
1.7.0~dfsg-1ubuntu1.1 |
underscoreUbuntu:18.04:LTS |
before 1.8.3~dfsg-1ubuntu0.1, plus listed versions 1.8.3~dfsg-1 |
1.8.3~dfsg-1ubuntu0.1 |
underscoreUbuntu:20.04:LTS |
before 1.9.1~dfsg-1ubuntu0.20.04.1, plus listed versions 1.9.1~dfsg-1 |
1.9.1~dfsg-1ubuntu0.20.04.1 |
nodejs-underscoreopenSUSE:Leap 15.2 |
before 1.13.1-lp152.4.3.1 | 1.13.1-lp152.4.3.1 |
nodejs-underscoreopenSUSE:Tumbleweed |
before 1.13.1-1.3 | 1.13.1-1.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | EkamSinghWalia/Detection-script-for-cve-2021-23358 | 2023-02-25 |
| PoC in GitHub | MehdiBoukhobza/SandBox_CVE-2021-23358 | 2024-07-04 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-23358 is a low vulnerability (CVSS 3.3) in Jashkenas Underscore, published March 29, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.20%, the 91st percentile. Fixed in underscore 1.12.1.
References
snyk.io/vuln/SNYK-JS-UNDERSCORE-1080984
github.com/jashkenas/underscore/blob/master/modules/template.js%23L71
lists.debian.org/debian-lts-announce/2021/03/msg00038.html
Show 194 moreShow less
debian.org/security/2021/dsa-4883
lists.apache.org/thread.html/re69ee408b3983b43e9c4a82a9a17cbbf8681bb91a4b61b46f365aeaf%40%3Cissues.cordova.apache.org%3E
tenable.com/security/tns-2021-14
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKATXXETD2PF3OR36Q5PD2VSVAR6J5Z
security.netapp.com/advisory/ntap-20240808-0003
seclists.org/fulldisclosure/2025/Apr/14
nvd.nist.gov/vuln/detail/CVE-2021-23358
npmjs.com/package/underscore
security-tracker.debian.org/tracker/CVE-2021-23358
advisories.mageia.org/MGASA-2021-0269.html
bugs.mageia.org/show_bug.cgi?id=29112
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1174
access.redhat.com/errata/RHSA-2021:2865
bugzilla.redhat.com/show_bug.cgi?id=1752996
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2865.json
cve.org/CVERecord?id=CVE-2020-7733
blog.jquery.com/2020/04/10/jquery-3-5-0-released
cisa.gov/known-exploited-vulnerabilities-catalog
ensy.zip/posts/dompurify-323-bypass
nsysean.github.io/posts/dompurify-323-bypass
go.dev/cl/700295
pkg.go.dev/vuln/GO-2025-4116
groups.google.com/g/golang-announce/c/8FJoBkPddm4
ubuntu.com/security/CVE-2021-23358
lists.opensuse.org/archives/list/[email protected]/thread/OYT735UU6WLJPI53DIIUEZ4OG2ZZSATO
bugzilla.suse.com/1184800
suse.com/security/cve/CVE-2021-23358
This page doesn't list everything
Left out here: 12 references. The JSON record has them.