CVE-2024-36361

1976-01-0100:00:00

mitre

www.cve.org

7 High

AI Score

Confidence

Low

0 Low

EPSS

Percentile

0.0%

JSON

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.