Executive brief
Underscore is a popular JavaScript utility library used by developers to handle common programming tasks. A flaw in the template function allows attackers to inject and execute arbitrary code by passing malicious variable properties as arguments, potentially compromising any application that uses this library to render user-supplied template content.
Technical details
The vulnerability is a code injection flaw (CWE-94) in underscore's template function, where variable properties passed as arguments are not properly sanitized before execution. An attacker can exploit this by crafting malicious template input that, when processed by the _.template function, results in arbitrary code execution. No authentication or user interaction is required—only network reachability to an application using the vulnerable function. The vulnerability affects underscore versions 1.3.2 through 1.12.0 and 1.13.0-0 through 1.13.0-1; patches are available in versions 1.12.1 and 1.13.0-2 and later.
Affected products
- underscore.js underscore 1.3.2 to 1.12.0, 1.13.0-0 to 1.13.0-1
Timeline
- 2021-03-29: disclosed
- 2021-03-29: patched: Fix merged; versions 1.12.1 and 1.13.0-2+ released
- 2021-05-06: advisory: GHSA-cf4h-3jhx-xvhq published