CVE-2024-36361

MediumCVSS 6.8

Published: 24/05/2024(UTC)Updated: 17/06/2026(UTC)Translated: 31/10/2026(UTC)NVD NIST

Summary

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. These functions compile Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

Risk Assessment

If an application passes untrusted input to the name option, an attacker could execute arbitrary JavaScript in the server or browser context, potentially leading to application compromise.

Recommendation

Update Pug to a version later than 3.0.2 if a fix is available. Avoid passing untrusted input to the name option in the mentioned functions.

Other vulnerabilities in Pug

CVE-2021-21353Medium
Pug is a template engine for Node.js. In versions before 3.0.1, if a remote attacker could control the `pretty` option of the Pug compiler (e.g., by spreading a user-provided object into template inputs), they could achieve remote code execution on the Node.js backend. This is fixed in version 3.0.1, with a backported fix for pug-code-gen in version 2.0.3.

Original NVD description (English source)

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS