CVE-2021-23358 Arbitrary Code Injection
Attackers can execute arbitrary code via the template function in the Underscore.js library when unsanitized variable properties are passed as arguments.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-23358?
CVE-2021-23358 is a low-severity code injection vulnerability in Debian Debian Linux, published on 29 Mar 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Weakness: CWE-94
Which versions are affected by CVE-2021-23358?
2 open source packages ship an affected version, including underscore. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
underscore npm | From 1.3.2 | 1.12.1 |
underscore npm | From 1.3.2 | 1.12.1 |
Linux distribution packages (2)
nodejs-underscore openSUSE:Leap 15.2 | All versions | 1.13.1-lp152.4.3.1 |
nodejs-underscore openSUSE:Tumbleweed | All versions | 1.13.1-1.3 |
Products include Debian Debian Linux, Fedoraproject Fedora, Tenable Tenable.sc, Underscorejs Underscore.
How do I fix CVE-2021-23358?
Upgrade underscore to 1.12.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2021-23358 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-23358 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-45222, CLSA-2026-1775003188, CLSA-2026-1775003190, DEBIAN-CVE-2021-23358, DLA-2613-1, DSA-4883-1 and 8 more.