Underscore: version with known vulnerabilities

best_practices.vulnerable_libraries.underscore

Outcome class: Automatic. An automated check that can report a confirmed violation.
Area: Security, vulnerable libraries

What the rule checks

Scope. Applies to pages on which the library is detected: its window global (with its version field) or, for jQuery, Bootstrap, AngularJS, Lodash and Handlebars, a script URL whose path names the library and a version.

Expectation. Fails for every Underscore below 1.13.8; 1.13.8 and later pass. Detected through `_.VERSION` without `_.runInContext` (with it, `_` is Lodash). Underscore has no URL channel in this detector. A page without the library: not applicable. A page that breaks the detection scripts (result missing or malformed) is not run for every library, never clean.

Source. retire.js jsrepository-v4.json (GitHub/NVD advisories), reviewed 2026-10-26; CVE-2021-23358 (< 1.12.1), CVE-2026-27601 (< 1.13.8)

Detection: analyze_vulnerable_libraries; needs dom.

Failing example

The check reports a violation here. Corpus case vulnerable_libs_underscore_last_vulnerable. The page may contain further findings for other rules.

vulnerable_libs_underscore_last_vulnerable.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Underscore just below the fix</title>
  <script>
    window._ = { VERSION: "1.13.7" };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>Underscore just below the fix</h1>

  </main>
</body>
</html>

Passing example

The check passes here and reports nothing. Corpus case vulnerable_libs_current_underscore. The page may contain further findings for other rules.

vulnerable_libs_current_underscore.htmlHTML

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Current Underscore</title>
  <script>
    // 1.13.8 fixes CVE-2026-27601, the last Underscore advisory.
    window._ = { VERSION: "1.13.8" };
  </script>
</head>
<body>
  <header><p>Library corpus</p></header>
  <main>
    <h1>Current Underscore</h1>

  </main>
</body>
</html>

This page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.