Security leak in _.template, please update

Question

Security leak in _.template, please update

jgonggrijp opened this issue 4 years ago · 4 comments

We were notified of a security issue in _.template, which appears to have existed since Underscore version 1.3.2. The bug was fixed in version 1.12.1 and 1.13.0-2, which I just published. If using NPM, please upgrade to underscore@latest or underscore@preview.

willdurand commented 4 years ago

thanks

Answer 1 · 2021-03-19T08:49:40.000Z

@jgonggrijp where is the 1.12.1 tag?

Answer 2 · 2021-03-19T12:10:34.000Z

@willdurand I intentionally postponed pushing that in order to give people who want to exploit the leak less to go on. I'll let you know when I push it.

Answer 3 · 2021-03-29T15:22:19.000Z

@willdurand The tag is online now.