{
"id": "GHSA-p493-635q-r6gr",
"aliases": [
"CVE-2021-21353"
],
"details": "### Impact\n\nIf a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend.\n\n### Patches\n\nUpgrade to `[email protected] ` or `[email protected] ` or `[email protected] `, which correctly sanitise the parameter.\n\n### Workarounds\n\nIf there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.\n\n### References\n\n\nOriginal report: https://github.com/pugjs/pug/issues/3312\n\n### For more information\n\nIf you believe you have found other vulnerabilities, please **DO NOT** open an issue. Instead, you can follow the instructions in our [Security Policy](https://github.com/pugjs/pug/blob/master/SECURITY.md)",
"summary": "Remote code execution via the `pretty` option.",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.0.1"
}
]
}
],
"package": {
"name": "pug",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.3"
}
]
}
],
"package": {
"name": "pug-code-gen",
"ecosystem": "npm"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.2"
}
]
}
],
"package": {
"name": "pug-code-gen",
"ecosystem": "npm"
}
}
],
"modified": "2025-04-16T22:09:45Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N"
}
],
"published": "2021-03-03T02:03:52Z",
"references": [
{
"url": "https://github.com/pugjs/pug/security/advisories/GHSA-p493-635q-r6gr",
"type": "WEB"
},
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21353",
"type": "ADVISORY"
},
{
"url": "https://github.com/pugjs/pug/issues/3312",
"type": "WEB"
},
{
"url": "https://github.com/pugjs/pug/pull/3314",
"type": "WEB"
},
{
"url": "https://github.com/pugjs/pug/commit/991e78f7c4220b2f8da042877c6f0ef5a4683be0",
"type": "WEB"
},
{
"url": "https://github.com/pugjs/pug/releases/tag/pug%403.0.1",
"type": "WEB"
},
{
"url": "https://www.npmjs.com/package/pug",
"type": "WEB"
},
{
"url": "https://www.npmjs.com/package/pug-code-gen",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-74",
"CWE-94"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2021-03-03T02:15:00Z",
"github_reviewed_at": "2021-03-03T01:49:22Z"
}
}