GitHub Advisoryadvisory · npm

GHSA-3965-hpx2-q597 Pug allows JavaScript code execution if an application accepts untrusted input

MEDIUM Published 2024-05-24 Modified 2025-04-28 Official page ↗
Aliases
CVE-2024-36361
Ecosystem
npm
Packages
pug-code-gen, pug
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-94
Reviewed
2024-05-24

Affected packages

• npm pug-code-gen: < 3.0.3 → fixed in 3.0.3 • npm pug: < 3.0.3 → fixed in 3.0.3

Description

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the `compileClient`, `compileFileClient`, or `compileClientWithDependenciesTracked` function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

Related

Alias · CVE (1)

  • CVE-2024-36361 Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient,… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References