GitStock

jashkenas/underscore · Security

Arbitrary Code Execution in underscore

GHSA ID
GHSA-cf4h-3jhx-xvhq
CVE ID
CVE-2021-23358
Severity
critical
Published
Updated
CVSS
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3
9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

CWEs

  • CWE-94 · Improper Control of Generation of Code ('Code Injection')

References

Open GitHub