StackRadar

CVE-2021-23358

Critical

Advisory

Published 29 Mar 2021In the index since 6 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.041
90th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
56
of 17,781 indexed, latest versions
Container images
54
deployed by those charts
Fix available
2 of 2
affected packages

Arbitrary Code Execution in underscore

Carried by container images the latest versions of 56 of 17,781 indexed charts deploy, on 54 images.

Affected packageAffected versionsFixed inImages
underscorenpm1.4.4, 1.5.2, 1.6.0, 1.7.0+6 more1.12.154
underscoredeb1.7.0~dfsg-1ubuntu1, 1.8.3~dfsg-11.7.0~dfsg-1ubuntu1.1, 1.8.3~dfsg-1ubuntu0.12
OSV records
GHSA-cf4h-3jhx-xvhqUBUNTU-CVE-2021-23358
Also known as
USN-4913-1

Charts affected

56 by stars
ChartLatestAffected imagesRadar Score
codimdphntom0.1.121 of 3See more

codimd phntom 0.1.12

1 of the 3 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
phntom/codimd:2.4.31b9aafbb62e6
underscore@1.8.3
1.12.1

Open the chart page →

6,524
wekanschmitzis1.1.11 of 1See more

wekan schmitzis 1.1.1

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
quay.io/wekan/wekan:v5.65cb17600883a3
underscore@1.9.1
1.12.1

Open the chart page →

3,638
dashkioskt3n2.0.01 of 1See more

dashkiosk t3n 2.0.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
quay.io/t3n/dashkiosk:v2.7.8c973e166a5dc
underscore@1.5.2
1.12.1

Open the chart page →

3,827
kubernetes-external-secretstrozz6.3.01 of 1See more

kubernetes-external-secrets trozz 6.3.0

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
underscore@1.10.2
1.12.1

Open the chart page →

2,838
genievhdirkVerified publisher0.1.31 of 1See more

genie vhdirk 0.1.3

1 of the 1 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
stanfordoval/almond-server:latest1a63cdccedaf
underscore@1.4.4
1.12.1

Open the chart page →

3,129
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2021-23358.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
underscore@1.6.0
1.12.1

Open the chart page →

5,459

Container images carrying it

54 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
pantsel/konga:latestc8172b75607d
underscore@1.6.0
1.12.1
3
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
underscore@1.11.0
1.12.1
2
mesosphere/kommander:6.100.13917e82333a9
underscore@1.9.1
1.12.1
2
migmartri/prerender:latest486aacfd5aa9
underscore@1.6.0
1.12.1
2
requarks/wiki:2:latest68f0d1848261
underscore@1.6.0
1.12.1
2
statsd/statsd:v0.8.6dab129e74c25
underscore@1.4.4
1.12.1
2
cryptexlabs/swagger-combine-ui:0.2.1ed0bc94fd412
underscore@1.7.0
1.12.1
1
daskdev/dask-notebook:1.1.0052630f5ca04
underscore@1.9.1
1.12.1
1
ethereumex/eth-stats-dashboard:v0.0.1a7603aa8df4c
underscore@1.7.0
underscore@1.7.0~dfsg-1ubuntu1
1.12.1
1.7.0~dfsg-1ubuntu1.1
1
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
underscore@1.9.1
1.12.1
1
ethersphere/bzz-token-service:latest7624f11a72ad
underscore@1.9.1
1.12.1
1
fiware/idm:8.3.3a1b6ed4ae84f
underscore@1.7.0
1.12.1
1
fiware/iotagent-ul:1.14.0fe11f55a926d
underscore@1.9.1
1.12.1
1
governify/collector-dynamic:v1.3.06d3d1a5b46a9
underscore@1.4.4
1.12.1
1
graphiteapp/graphite-statsd:1.1.7-604a0037cc2ae
underscore@1.4.4
1.12.1
1
ibmcom/bai-admin-dev:19.0.202d882f2836e
underscore@1.7.0
1.12.1
1
ibmcom/microclimate-portal:latested5505e5c7ec
underscore@1.7.0
1.12.1
1
interlayhq/interbtc-hydra-processor:master-2c6e16e-1637088364423d567d47aa
underscore@1.6.0
1.12.1
1
jayfong/yapi:1.10.2163e5d621910
underscore@1.8.3
1.12.1
1
konradkleine/docker-registry-frontend:v2181aad54ee64
underscore@1.7.0
1.12.1
1
kubeflownotebookswg/centraldashboard:v1.6.137300551dea6
underscore@1.7.0
1.12.1
1
kyleslugg/klusterview:latestba8c36dfdfbd
underscore@1.5.2
1.12.1
1
library/ghost:6.25.12654b1e90413
underscore@1.8.3
1.12.1
1
library/ghost:4.37.0767230c0f263
underscore@1.7.0
1.12.1
1
library/ghost:5.79.083f7bf209844
underscore@1.7.0
1.12.1
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
underscore@1.7.0
1.12.1
1
linuxserver/codimd:latestb801bbcf6386
underscore@1.8.3
1.12.1
1
matrixdotorg/matrix-appservice-gitter:latest0d37b4d42b47
underscore@1.9.2
1.12.1
1
microcks/microcks-postman-runtime:latestcb72e46a1b3c
underscore@1.7.0
1.12.1
1
minddocdev/hubot:0.1.96c60b11a4fa7
underscore@1.8.3
1.12.1
1
netrisai/controller-web-service-backend:4.6.0-0086e865080e86c
underscore@1.8.3
1.12.1
1
openhab/openhab-cloud:a8138a329dd2bac8c4b
underscore@1.7.0
1.12.1
1
openthread/otbr:latestf307f59f6432
underscore@1.8.3
1.12.1
1
openwhisk/ow-utils:1.0.0c80dba0de3aa
underscore@1.8.3
underscore@1.8.3~dfsg-1
1.12.1
1.8.3~dfsg-1ubuntu0.1
1
parithoshj/testnet-faucet:9859e0dcdca426fea6d
underscore@1.8.3
1.12.1
1
phntom/codimd:2.4.31b9aafbb62e6
underscore@1.8.3
1.12.1
1
requarks/wiki:canary-2.5.2438b5865a7386c
underscore@1.8.3
1.12.1
1
shinobisystems/shinobi:dev3ca746937856
underscore@1.4.4
1.12.1
1
shinobisystems/shinobi:latestc2f5ce2e1067
underscore@1.4.4
1.12.1
1
stanfordoval/almond-server:latest1a63cdccedaf
underscore@1.4.4
1.12.1
1
wekanteam/wekan:v4.2268a51f0327df
underscore@1.7.0
1.12.1
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
underscore@1.4.4
1.12.1
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
underscore@1.4.4
1.12.1
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
underscore@1.4.4
1.12.1
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
underscore@1.4.4
1.12.1
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
underscore@1.4.4
1.12.1
1
ghcr.io/external-secrets/kubernetes-external-secrets:6.3.0eab9bd0b6986
underscore@1.10.2
1.12.1
1
ghcr.io/linuxserver/raneto:version-0.16.6ef768f3df5d0
underscore@1.12.0
1.12.1
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
underscore@1.6.0
1.12.1
1
quay.io/ctrontesting/iofog-controller:latest10df27bc5560
underscore@1.7.0
1.12.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.