Lucene search
Veracode Vulnerability DatabaseVERACODE:47205HistoryMay 28, 2024 - 4:57 a.m.
Code Injection
2024-05-2804:57:11
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
code injection
pug
input validation
execute arbitrary javascript
application context
pug is vulnerable to Code execution. The vulnerability is due to the lack of proper input validation for the name option in the compileClient, compileFileClient, or compileClientWithDependenciesTracked functions, which allows attackers to execute arbitrary JavaScript code in the context of the application.
| CPE | Name | Operator | Version |
|---|---|---|---|
| pug | le | 3.0.2 | |
| pug-code-gen | le | 3.0.2 | |
| pug-code-gen | eq | 2.0.1 | |
| pug | le | 3.0.2 | |
| pug-code-gen | le | 3.0.2 | |
| pug-code-gen | eq | 2.0.1 |
Related
cve
cve
CVE-2024-36361
2024-05-24 06:15:08
cvelist
cvelist
CVE-2024-36361
1976-01-01 00:00:00
osv
osv
vulnrichment
vulnrichment
CVE-2024-36361
1976-01-01 00:00:00
nvd
nvd
CVE-2024-36361
2024-05-24 06:15:08
github
github