Attestkeep
Sprache: Deutsch
Loslegen

Schwachstellen / CVE-2021-21353

kritisch

CVE-2021-21353

pug: user provided objects as input to pug templates can achieve remote code execution

Veröffentlicht Geändert CWE 74, 94
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.

Einstufung nach Quelle

NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
GHSA6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (mittel), Red Hat (mittel).

Beschreibung

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

Betroffene Pakete und behobene Versionen

QuellePaketBehoben in
chainguardcode-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 und 38 weitere0
npm::GitHub Security Advisory npmpug, pug-code-gen3.0.1 und 1 weitere
wolficode-server0
Alle 44 Einträge aus 3 Quellen zeigen
QuellePaketBehoben in
chainguardcode-server0
chainguardcommercial-gitlab-rails-ee-19.20
chainguardcommercial-gitlab-rails-ee-19.30
chainguardcommercial-gitlab-rails-ee-19.40
chainguardcommercial-gitlab-rails-ee-fips-19.20
chainguardcommercial-gitlab-rails-ee-fips-19.30
chainguardcommercial-gitlab-rails-ee-fips-19.40
chainguardgitlab-rails-ce-18.10
chainguardgitlab-rails-ce-18.100
chainguardgitlab-rails-ce-18.110
chainguardgitlab-rails-ce-18.20
chainguardgitlab-rails-ce-18.30
chainguardgitlab-rails-ce-18.40
chainguardgitlab-rails-ce-18.50
chainguardgitlab-rails-ce-18.60
chainguardgitlab-rails-ce-18.70
chainguardgitlab-rails-ce-18.80
chainguardgitlab-rails-ce-18.90
chainguardgitlab-rails-ce-19.00
chainguardgitlab-rails-ce-19.10
chainguardgitlab-rails-ce-19.20
chainguardgitlab-rails-ce-19.30
chainguardgitlab-rails-ce-19.40
chainguardgitlab-rails-ce-19.50
chainguardgitlab-rails-ce-fips-18.10
chainguardgitlab-rails-ce-fips-18.100
chainguardgitlab-rails-ce-fips-18.110
chainguardgitlab-rails-ce-fips-18.20
chainguardgitlab-rails-ce-fips-18.30
chainguardgitlab-rails-ce-fips-18.40
chainguardgitlab-rails-ce-fips-18.50
chainguardgitlab-rails-ce-fips-18.60
chainguardgitlab-rails-ce-fips-18.70
chainguardgitlab-rails-ce-fips-18.80
chainguardgitlab-rails-ce-fips-18.90
chainguardgitlab-rails-ce-fips-19.00
chainguardgitlab-rails-ce-fips-19.10
chainguardgitlab-rails-ce-fips-19.20
chainguardgitlab-rails-ce-fips-19.30
chainguardgitlab-rails-ce-fips-19.40
chainguardgitlab-rails-ce-fips-19.50
npm::GitHub Security Advisory npmpug3.0.1
npm::GitHub Security Advisory npmpug-code-gen2.0.3, 3.0.2
wolficode-server0

Referenzen

Alle 10 Referenzen

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.