CVE-2021-23358 - medium detected in underscore

[github-actions]

Package Name: underscore
Package Version: ['1.9.1']
Package Manager: npm
Target File: package.json
Severity Level: medium
Snyk ID: SNYK-JS-UNDERSCORE-1080984
Snyk CVE: CVE-2021-23358
Snyk CWE: CWE-94
Link to issue in Snyk: https://app.snyk.io/org/rhicksiii91/project/93ddcac2-4d2c-43e7-b383-b47b30846d11

Snyk Description: ## Overview
underscore is a JavaScript's functional programming helper library.

Affected versions of this package are vulnerable to Arbitrary Code Injection via the template function, particularly when the variable option is taken from _.templateSettings as it is not sanitized.

PoC

const _ = require('underscore');
_.templateSettings.variable = "a = this.process.mainModule.require('child_process').execSync('touch HELLO')";
const t = _.template("")();

Remediation

Upgrade underscore to version 1.13.0-2, 1.12.1 or higher.

References

• GitHub Additional Information
• GitHub Commit

[github-actions]

auto-closed by snyk_scm_issues_to_gh_issues
reason: snyk project no longer exists