-
-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CVE-2021-23358 (High) detected in underscore-1.6.0.tgz #2072
Comments
This was referenced Nov 21, 2021
This issue is potentially a duplicate of one of the following issues:
|
Sorry, friend. As far as this ol' bot can tell, your issue does not properly use one of this repo's available issue templates. Please try again, if you like. (And if I'm confused, please let us know. 😬)
|
👋 Thanks for reporting! |
This old thread has been automatically locked. If you think you have found something related to this, please open a new issue by following the issue guide (https://github.com/AlexRogalskiy/typescript-tools/blob/master/.github/ISSUE_TEMPLATE/bug_report.md), and link to this old issue if necessary. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
None yet
0 participants
CVE-2021-23358 - High Severity Vulnerability
Vulnerable Library - underscore-1.6.0.tgz
JavaScript's functional programming helper library.
Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz
Path to dependency file: typescript-tools/package.json
Path to vulnerable library: typescript-tools/node_modules/underscore/package.json
Dependency Hierarchy:
Found in HEAD commit: b538a12aeffb8538afc95ea85e6fc890c4652979
Vulnerability Details
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Publish Date: 2021-03-29
URL: CVE-2021-23358
CVSS 3 Score Details (7.2)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358
Release Date: 2021-03-29
Fix Resolution: underscore - 1.12.1,1.13.0-2
Step up your Open Source Security Game with WhiteSource here
The text was updated successfully, but these errors were encountered: