h3. Issue Summary

Jira system is currently using underscore.js 1.9.1. However, it is being affected due to [CVE-2021-23358|https://vulners.com/cve/CVE-2021-23358]

• The package underscore from 1.13.0-0 and before 1.13.0-2
• From 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

h3. Steps to Reproduce

Install Jira Software 8.17 or below;

h3. Expected Results

Have Jira using  underscore.js 1.13.1 or higher.
h3. Actual Results

Jira is using underscore.js 1.9.1
h3. Workaround

No workaround is available.