{"action":"Upgrade underscore to 1.9.1~dfsg-2 or later.","affected":[{"fixed":"1.9.1~dfsg-2","introduced":"0"}],"component":"underscore","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["1.9.1~dfsg-2"],"id":"tcs_01M5NFETG1178REPVTV1HB6NWS","modified_at":"2026-10-23T18:03:37.169647783Z","published_at":"2021-03-29T14:15:18.047Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-23358","https://security-tracker.debian.org/tracker/CVE-2021-23358"],"severity":{"label":"high","score":7.2},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-23358#Debian:14/underscore","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-23358"}],"summary":"The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is pa"}