pug vulnerabilities

CVEs whose affected-version data names the pug package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2021-21353Medium· 6.8PoC

5y ago

Remote code execution in pug

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the quer…

▾ Twilightpugjs · pugEPSS 4.3%via CVEORG