CVE-2021-23358

Arbitrary Code Injection

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

We have discovered 127,173 live websites that are affected by CVE-2021-23358.

Run a Free Instant Scan



Affected Software

Product  underscore
Category JavaScript Libraries
Vulnerable Domains127,173 live websites (10% of underscore install base)
Vulnerable Versions
  • from 1.3.2 through 1.12.1
  • from 1.13 through 1.13
Vulnerable Versions Count22 versions ( 52% of all versions)



Details

  • Published - Mar 29, 2021
  • Updated - Nov 3, 2025

Credits

  • Alessio Della Libera (@d3lla)

Website Distribution by Country

Number of websites using CVE-2021-23358
United States43,293 websites


Germany8,928 websites
France6,998 websites
Italy6,867 websites
GB4,760 websites
Russia4,251 websites
Netherlands3,539 websites
Spain3,437 websites
Canada3,284 websites
Poland2,978 websites

Website Distribution by TLD

Number of websites using CVE-2021-23358
.com56,977 websites
.org5,919 websites
.it4,688 websites
.de4,376 websites
.ru3,318 websites
.net3,204 websites
.co.uk2,969 websites
.nl2,910 websites
.fr2,866 websites
.pl2,291 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2021-23358

Top websites that are affected by CVE-2021-23358. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
*******.com United States*,***
************.com United States*,***
**********.com United States*,***
*******.com United States*,***
********.com United States*,***
************.com United States*,***
************.com United States*,***
*********.io Netherlands*,***
*******.com United States*,***
*********.com United States*,***
See full domain list

FAQ

A total of 127,173 websites have been identified as vulnerable to CVE-2021-23358, based on global website indexing conducted by WebTechSurvey.
The underscore is affected by the CVE-2021-23358 vulnerability.
underscore versions up to and including 1.13 are vulnerable to CVE-2021-23358.

References