Issue Summary

UPM is currently using underscore.js 1.4.4. However, it is being affected due to CVE-2021-23358

The package underscore from 1.13.0-0 and before 1.13.0-2
From 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Steps to Reproduce

1. Install Confluence 7.13.1 or below

Expected Results

Have Confluence using underscore.js 1.13.1 or higher.

Actual Results

UPM in Confluence is using underscore.js 1.4.4 which is affected.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available