diff --git a/doc/develop/html/index.html b/doc/develop/html/index.html
index be799258..4d33c94b 100644
--- a/doc/develop/html/index.html
+++ b/doc/develop/html/index.html
@@ -126,7 +126,7 @@
   </p>
 </div>
 <table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
-<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:22 GMT</small></p></td>
+<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:23 GMT</small></p></td>
 <td align="right"><div class="copyright-footer"></div></td>
 </tr></table>
 <hr>
diff --git a/doc/develop/html/numpy/.doctrees/environment.pickle b/doc/develop/html/numpy/.doctrees/environment.pickle
index de0444fc..31ef42ff 100644
Binary files a/doc/develop/html/numpy/.doctrees/environment.pickle and b/doc/develop/html/numpy/.doctrees/environment.pickle differ
diff --git a/doc/develop/html/numpy/_static/underscore.js b/doc/develop/html/numpy/_static/underscore.js
index 8219dc50..709ae8e3 100644
--- a/doc/develop/html/numpy/_static/underscore.js
+++ b/doc/develop/html/numpy/_static/underscore.js
@@ -1550,6 +1550,13 @@
     return '\\' + escapes[match];
   };
 
+  // In order to prevent third-party code injection through
+  // `_.templateSettings.variable`, we test it against the following regular
+  // expression. It is intentionally a bit more liberal than just matching valid
+  // identifiers, but still prevents possible loopholes through defaults or
+  // destructuring assignment.
+  var bareIdentifier = /^\s*(\w|\$)+\s*$/;
+
   // JavaScript micro-templating, similar to John Resig's implementation.
   // Underscore templating handles arbitrary delimiters, preserves whitespace,
   // and correctly escapes quotes within interpolated code.
@@ -1585,8 +1592,17 @@
     });
     source += "';\n";
 
-    // If a variable is not specified, place data values in local scope.
-    if (!settings.variable) source = 'with(obj||{}){\n' + source + '}\n';
+    var argument = settings.variable;
+    if (argument) {
+      // Insure against third-party code injection.
+      if (!bareIdentifier.test(argument)) throw new Error(
+        'variable is not a bare identifier: ' + argument
+      );
+    } else {
+      // If a variable is not specified, place data values in local scope.
+      source = 'with(obj||{}){\n' + source + '}\n';
+      argument = 'obj';
+    }
 
     source = "var __t,__p='',__j=Array.prototype.join," +
       "print=function(){__p+=__j.call(arguments,'');};\n" +
@@ -1594,7 +1610,7 @@
 
     var render;
     try {
-      render = new Function(settings.variable || 'obj', '_', source);
+      render = new Function(argument, '_', source);
     } catch (e) {
       e.source = source;
       throw e;
@@ -1605,7 +1621,6 @@
     };
 
     // Provide the compiled source as a convenience for precompilation.
-    var argument = settings.variable || 'obj';
     template.source = 'function(' + argument + '){\n' + source + '}';
 
     return template;
diff --git a/doc/develop/html/reference/index.html b/doc/develop/html/reference/index.html
index ad370f06..6cfde3c2 100644
--- a/doc/develop/html/reference/index.html
+++ b/doc/develop/html/reference/index.html
@@ -127,7 +127,7 @@
 </div>
 </div>
 <table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
-<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:21 GMT</small></p></td>
+<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:26 GMT</small></p></td>
 <td align="right"><div class="copyright-footer"></div></td>
 </tr></table>
 <hr>
diff --git a/doc/develop/html/tutorial/index.html b/doc/develop/html/tutorial/index.html
index 8586fa7a..8d2d2c27 100644
--- a/doc/develop/html/tutorial/index.html
+++ b/doc/develop/html/tutorial/index.html
@@ -140,7 +140,7 @@
 </div>
 </div>
 <table xmlns:rev="http://www.cs.rpi.edu/~gregod/boost/tools/doc/revision" width="100%"><tr>
-<td align="left"><p><small>Last revised: March 16, 2021 at 20:19:31 GMT</small></p></td>
+<td align="left"><p><small>Last revised: April 16, 2021 at 19:35:23 GMT</small></p></td>
 <td align="right"><div class="copyright-footer"></div></td>
 </tr></table>
 <hr>