https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 18 Oct 2026 21:51:23 +0000 https://cve.radiocsirt.org/vuln/bdu:2021-02843 bdu:2021-02843 https://cve.radiocsirt.org/vuln/bdu:2021-02843 https://cve.radiocsirt.org/vuln/euvd-2026-231355 EUVD-2026-231355 https://cve.radiocsirt.org/vuln/euvd-2026-231355 https://cve.radiocsirt.org/vuln/fkie_cve-2021-21353 <p>Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including &#34;pug&#34;, &#34;pug-code-gen&#34;. pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.</p> <p>Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including &#34;pug&#34;, &#34;pug-code-gen&#34;. pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-21353 https://cve.radiocsirt.org/vuln/ghsa-p493-635q-r6gr <p><strong>Affected:</strong> npm: pug, npm: pug-code-gen</p> <p>### Impact</p> <p>If a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend.</p> <p>### Patches</p> <p>Upgrade to `pug@3.0.1` or `pug-code-gen@3.0.2` or `pug-code-gen@2.0.3`, which correctly sanitise the parameter.</p> <p>### Workarounds</p> <p>If there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.</p> <p>### References</p> <p>Original report: https://github.com/pugjs/pug/issues/3312</p> <p>### For more information</p> <p>If you believe you have found other vulnerabilities, please **DO NOT** open an issue. Instead, you can follow the instructions in our [Security Policy](https://github.com/pugjs/pug/blob/master/SECURITY.md)</p> <p><strong>Affected:</strong> npm: pug, npm: pug-code-gen</p> <p>### Impact</p> <p>If a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend.</p> <p>### Patches</p> <p>Upgrade to `pug@3.0.1` or `pug-code-gen@3.0.2` or `pug-code-gen@2.0.3`, which correctly sanitise the parameter.</p> <p>### Workarounds</p> <p>If there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.</p> <p>### References</p> <p>Original report: https://github.com/pugjs/pug/issues/3312</p> <p>### For more information</p> <p>If you believe you have found other vulnerabilities, please **DO NOT** open an issue. Instead, you can follow the instructions in our [Security Policy](https://github.com/pugjs/pug/blob/master/SECURITY.md)</p> https://cve.radiocsirt.org/vuln/ghsa-p493-635q-r6gr https://cve.radiocsirt.org/vuln/gsd-2021-21353 gsd-2021-21353 https://cve.radiocsirt.org/vuln/gsd-2021-21353