`underscore`

Ecosystem:
npm

Package URL:
pkg:npm/underscore

Total PRs:
645 Dependabot PRs

Latest PR:
9 days ago

Unique Repositories:
461 repositories

Unique Repos (30 days):
15 repositories

Security Advisories

Arbitrary Code Execution in underscore

GHSA-cf4h-3jhx-xvhq CVE-2021-23358 CRITICAL published about 5 years ago • updated 3 days ago

The package `underscore` from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Execution via the templat...

Underscore has unlimited recursion in _.flatten and _.isEqual, potential for DoS attack

GHSA-qpx9-hpmf-5gmw CVE-2026-27601 HIGH published 4 months ago • updated 14 days ago

### Impact In simple words, some programs that use `_.flatten` or `_.isEqual` could be made to crash. Someone who wants to do harm may be able to ...

Recent PRs

RSS Feed

Bump the npm_and_yarn group across 1 directory with 30 updates

fadol83-lab/adam-lynch.github.io #1

1.8.3 → 1.13.7 Minor PR

Open 7 months ago 1 comment

chore(deps): bump the minor-and-patch group across 1 directory with 39 updates

UDA-EJIE/udaRUP #333

1.13.6 → 1.13.7 Patch PR

Open 7 months ago 2 comments

chore(deps): bump the minor-and-patch group across 1 directory with 37 updates

UDA-EJIE/udaRUP #331

1.13.6 → 1.13.7 Patch PR

Open 8 months ago 3 comments

chore(deps): bump the minor-and-patch group across 1 directory with 36 updates

UDA-EJIE/udaRUP #330

1.13.6 → 1.13.7 Patch PR

Open 8 months ago 2 comments

chore(deps): bump the minor-and-patch group across 1 directory with 35 updates

UDA-EJIE/udaRUP #329

1.13.6 → 1.13.7 Patch PR

Open 8 months ago 3 comments

build(deps): bump underscore and highlight.js

slievrly/fescar-group.github.io #12

removed Removal PR

Open 8 months ago

chore(deps): bump the minor-and-patch group with 33 updates

UDA-EJIE/udaRUP #319

1.13.6 → 1.13.7 Patch PR

Open 8 months ago 3 comments

Bump the npm_and_yarn group across 1 directory with 18 updates

ArmorCode-Public-Test/NodeGoat #61

1.9.1 → 1.13.7 Minor PR

Open 8 months ago

Bump the npm_and_yarn group across 1 directory with 17 updates

ArmorCode-Public-Test/NodeGoat #60

1.9.1 → 1.13.7 Minor PR

Open 8 months ago 2 comments

Bump underscore and grunt

dmanzer2/dminfo.github.io #8

removed Removal PR

Open 8 months ago

Update underscore requirement from ^1.13.6 to ^1.13.7 in /superset-frontend/plugins/legacy-preset-chart-deckgl

csronakpadaliya/superset-4.1.4 #37

^1.13.6 → ^1.13.7 Patch PR

Open 8 months ago 1 comment

Bump underscore from 1.8.3 to 1.13.7 in /backend

Wilcolab/Anythink-Market-t21wrnnq #6

1.8.3 → 1.13.7 Minor PR

Open 9 months ago

Bump underscore from 1.8.3 to 1.12.1 in the npm_and_yarn group across 1 directory

MACantara/browser-laptop #2

1.8.3 → 1.12.1 Minor PR

Open 9 months ago

Bump the npm_and_yarn group across 4 directories with 3 updates

aredridel/npm #1

1.3.1 → 1.12.1 Minor PR

Open 9 months ago

Bump underscore from 1.13.6 to 1.13.7

daniel-2k/ioBroker.nanoleaf-lightpanels #171

1.13.6 → 1.13.7 Patch PR

Merged 9 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 3 updates

raviqqe/sequelize-optimistic-locking #1

1.9.1 → 1.13.7 Minor PR

Open 9 months ago

Bump the npm_and_yarn group across 1 directory with 10 updates

24601/resume-parser #6

1.8.3 → 1.12.1 Minor PR

Open 9 months ago

chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates

hashim21223445/xstream #9

1.8.3 → 1.13.7 Minor PR

Open 9 months ago

Bump underscore and grunt-retire

Test1-LS-demo/NodeGoat #5

1.9.1 → 1.13.7 Minor PR

Open 9 months ago

Bump underscore from 1.9.1 to 1.13.7 in /periodic-test

jgeofil/actor-google-sheets #5

1.9.1 → 1.13.7 Minor PR

Open 9 months ago 1 comment

Bump underscore from 1.13.2 to 1.13.7

jgeofil/actor-google-sheets #2

1.13.2 → 1.13.7 Patch PR

Open 9 months ago 1 comment

chore(deps): update underscore requirement from ^1.13.6 to ^1.13.7 in /superset-frontend/plugins/legacy-preset-chart-deckgl

alx25/superset #51

^1.13.6 → ^1.13.7 Patch PR

Open 9 months ago 1 comment

Bump underscore from 1.11.0 to 1.13.7

City-of-Helsinki/aula-wp-theme #11

1.11.0 → 1.13.7 Minor PR

Merged 9 months ago 1 comment

Bump the npm_and_yarn group across 5 directories with 43 updates

cp90-pixel/atom #12

1.13.6 → 1.13.7 Patch PR

Open 9 months ago

Bump the npm_and_yarn group across 5 directories with 42 updates

cp90-pixel/atom #11

1.13.6 → 1.13.7 Patch PR

Closed 9 months ago 1 comment

chore(deps): bump underscore from 1.9.2 to 1.13.7 in /frontend/server

customink/kubeflow-pipelines #2

1.9.2 → 1.13.7 Minor PR

Open 9 months ago

chore(deps): bump the npm_and_yarn group across 4 directories with 23 updates

stakhouse101/lighthouse-ci #4

1.9.1 → 1.13.7 Minor PR

Open 9 months ago

Bump underscore from 1.7.0 to 1.13.7

epi-org/jsonpath #7

1.7.0 → 1.13.7 Minor PR

Open 9 months ago

Bump underscore and jsdoc

jeremyckahn/rekapi #108

1.10.2 → 1.13.7 Minor PR

Merged 9 months ago

Bump underscore from 1.4.4 to 1.13.7

learningequality/kolibri #13726

1.4.4 → 1.13.7 Minor PR

Open 9 months ago

Bump the npm_and_yarn group across 0 directory with 2 updates

larralapid/cv.larralapid.dev #2

1.6.0 → 1.8.3 Minor PR

Open 9 months ago

Bump the npm_and_yarn group across 1 directory with 18 updates

Chukwuemeka-Test-Org/test-repo-0-174769878_herein #149

1.8.2 → 1.12.1 Minor PR

Open 9 months ago

Bump the npm_and_yarn group across 1 directory with 4 updates

catch-oss/jquery-mobile #1

1.5.2 → 1.12.1 Minor PR

Open 9 months ago

build(deps): bump the npm_and_yarn group across 1 directory with 41 updates

ksuzy31-org/nodejs-goof #35

1.9.1 → 1.12.1 Minor PR

Open 10 months ago

build(deps): bump the npm_and_yarn group across 1 directory with 42 updates

ksuzy31-org/nodejs-goof #27

1.9.1 → 1.12.1 Minor PR

Open 10 months ago

deps: bump underscore from 1.12.0 to 1.13.7

VicAgudelo/vuln-demo #8

1.12.0 → 1.13.7 Minor PR

Open 10 months ago

Bump underscore and azure-devops-node-api

TopperKain/process-migrator #5

1.8.3 → 1.13.7 Minor PR

Open 10 months ago

Bump the npm_and_yarn group across 1 directory with 2 updates

sumitb/pdf.js #1

1.4.4 → 1.13.7 Minor PR

Merged 10 months ago

Bump underscore from 1.10.2 to 1.13.7

zachhardesty7/connect-door #41

1.10.2 → 1.13.7 Minor PR

Open 10 months ago

Bump underscore and remarkable

sparck75/react-stockcharts #3

removed Removal PR

Open 10 months ago

build(deps): bump the npm_and_yarn group across 1 directory with 15 updates

joffcrabtree/Leanplum-JavaScript-SDK #1

1.8.3 → 1.12.1 Minor PR

Closed 10 months ago 1 comment

Update underscore requirement from ^1.12.1 to ^1.13.7 in /superset-frontend/plugins/legacy-preset-chart-deckgl

tinzisreal/off-set #20

^1.12.1 → ^1.13.7 Minor PR

Open 10 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 13 updates

alexanderjensen-source/react-timeseries-charts #9

1.9.1 → 1.12.1 Minor PR

Open 10 months ago

Bump the npm_and_yarn group across 1 directory with 14 updates

alexanderjensen-source/react-timeseries-charts #8

1.9.1 → 1.12.1 Minor PR

Open 10 months ago

Bump the npm_and_yarn group across 1 directory with 13 updates

alexanderjensen-source/react-timeseries-charts #7

1.9.1 → 1.12.1 Minor PR

Closed 10 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 13 updates

alexanderjensen-source/react-timeseries-charts #2

1.9.1 → 1.12.1 Minor PR

Open 10 months ago

Bump the npm_and_yarn group across 1 directory with 11 updates

alexanderjensen-source/react-timeseries-charts #1

1.9.1 → 1.12.1 Minor PR

Closed 10 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 33 updates

twcctz200/lighthouse-ci #1

1.9.1 → 1.13.7 Minor PR

Open 10 months ago

build(deps-dev): bump underscore from 1.8.3 to 1.12.1 in /public/lib/lazy.js-0.5.1

glpi-project/glpi-inventory-plugin #716

1.8.3 → 1.12.1 Minor PR

Closed 10 months ago 1 comment

Bump the npm_and_yarn group across 1 directory with 2 updates

joffcrabtree/woocommerce-customizer #1

1.6.0 → 1.13.7 Minor PR

Open 10 months ago

Package Details

Name:	`underscore`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/underscore`
JSON API:	View JSON

Security Advisories

2

Active advisories

CRITICAL 1

HIGH 1

View All npm Advisories

Package Information

Description:

JavaScript's functional programming helper library.

Repository:	https://github.com/jashkenas/underscore
Homepage:	https://underscorejs.org
Latest Release:	`1.13.7` almost 2 years ago
Dependent Repos:	738,210
Dependent Packages:	25,330
Downloads:	62,844,288
Ranking:	Top 0.042% by dependent repos Top 0.0307% by downloads Top 0.0044% by dependent pkgs

PR Status

Open 302 (46.8%)

Merged 17 (2.6%)

Closed 314 (48.7%)

PR Types

Minor 242 (37.5%)

Patch 372 (57.7%)

Removal 11 (1.7%)