pug (>=3.0.0-canary-1, <=3.0.0-canary-2) potentially affected by CVE-2021-21353 via pug-code-gen (>=3.0.0-canary-1, <=3.0.0-canary-2)

pug-code-gen NPM version =3.0.0-canary-1, =3.0.0-canary-1, =3.0.0-canary-2 Source cves: CVE-2021-21353 Source advisory: OSV:GHSA-P493-635Q-R6GR...

CVE-2021-21353

CVE-2021-21353 affects the Pug template engine before v3.0.1. If an attacker controls the pretty option via untrusted input (e.g., query params passed into template inputs), remote code execution on the Node.js backend was possible. The issue is fixed in v3.0.1; pug-code-gen has a backport fix in...