Underscorejs Underscore — known CVE vulnerabilities

Every CVE whose affected-product data names Underscorejs Underscore, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (2)

• CVE-2026-27601 — CVSS 5.9 (medium): Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a…
• CVE-2021-23358 — CVSS 3.3 (low): The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the…