h3. Issue Summary
Confluence is currently using underscore.js 1.10.2. However, it is being affected due to CVE-2021-23358

The package underscore from 1.13.0-0 and before 1.13.0-2
From 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

h3. Steps to Reproduce

Install Confluence 7.13.1 or below

h3. Expected Results
Have Confluence using underscore.js 1.13.1 or higher.

h3. Actual Results
Confluence is using underscore.js 1.10.2 which is affected.

h3. Workaround
Currently there is no known workaround for this behavior. A workaround will be added here when available