Attestkeep
Idioma: Español
Registrarse

Vulnerabilidades / CVE-2021-21353

crítica

CVE-2021-21353

pug: user provided objects as input to pug templates can achieve remote code execution

Publicada Modificada CWE 74, 94
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.

Severidad por fuente

NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
GHSA6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (media), Red Hat (media).

Descripción

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

Paquetes afectados y versiones corregidas

FuentePaqueteCorregido en
chainguardcode-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 y 38 más0
npm::GitHub Security Advisory npmpug, pug-code-gen3.0.1 y 1 más
wolficode-server0
Mostrar las 44 entradas de 3 fuentes
FuentePaqueteCorregido en
chainguardcode-server0
chainguardcommercial-gitlab-rails-ee-19.20
chainguardcommercial-gitlab-rails-ee-19.30
chainguardcommercial-gitlab-rails-ee-19.40
chainguardcommercial-gitlab-rails-ee-fips-19.20
chainguardcommercial-gitlab-rails-ee-fips-19.30
chainguardcommercial-gitlab-rails-ee-fips-19.40
chainguardgitlab-rails-ce-18.10
chainguardgitlab-rails-ce-18.100
chainguardgitlab-rails-ce-18.110
chainguardgitlab-rails-ce-18.20
chainguardgitlab-rails-ce-18.30
chainguardgitlab-rails-ce-18.40
chainguardgitlab-rails-ce-18.50
chainguardgitlab-rails-ce-18.60
chainguardgitlab-rails-ce-18.70
chainguardgitlab-rails-ce-18.80
chainguardgitlab-rails-ce-18.90
chainguardgitlab-rails-ce-19.00
chainguardgitlab-rails-ce-19.10
chainguardgitlab-rails-ce-19.20
chainguardgitlab-rails-ce-19.30
chainguardgitlab-rails-ce-19.40
chainguardgitlab-rails-ce-19.50
chainguardgitlab-rails-ce-fips-18.10
chainguardgitlab-rails-ce-fips-18.100
chainguardgitlab-rails-ce-fips-18.110
chainguardgitlab-rails-ce-fips-18.20
chainguardgitlab-rails-ce-fips-18.30
chainguardgitlab-rails-ce-fips-18.40
chainguardgitlab-rails-ce-fips-18.50
chainguardgitlab-rails-ce-fips-18.60
chainguardgitlab-rails-ce-fips-18.70
chainguardgitlab-rails-ce-fips-18.80
chainguardgitlab-rails-ce-fips-18.90
chainguardgitlab-rails-ce-fips-19.00
chainguardgitlab-rails-ce-fips-19.10
chainguardgitlab-rails-ce-fips-19.20
chainguardgitlab-rails-ce-fips-19.30
chainguardgitlab-rails-ce-fips-19.40
chainguardgitlab-rails-ce-fips-19.50
npm::GitHub Security Advisory npmpug3.0.1
npm::GitHub Security Advisory npmpug-code-gen2.0.3, 3.0.2
wolficode-server0

Referencias

Las 10 referencias

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.