Skip to content
OpenAdvisories

Package · npm

pug

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.8
    CVE-2024-36361

    Pug allows JavaScript code execution if an application accepts untrusted input

    Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates i…

    pug pug-code-gen npm
  • Medium 6.8
    CVE-2021-21353 Public exploit

    Remote code execution in pug

    Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a reque…

    pugjs pug pug pug-code-gen npm