~ / search / GHSA-3965-hpx2-q597

GHSA-3965-hpx2-q597

Pug allows JavaScript code execution if an application accepts untrusted input

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-36361

Packages

EcosystemPackageAffectedFixed in
npm pug-code-gen < 3.0.3 3.0.3
npm pug < 3.0.3 3.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the `compileClient`, `compileFileClient`, or `compileClientWithDependenciesTracked` function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

References

External links from the advisory. They lead to third-party sites.