Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2021-21353

critical

CVE-2021-21353

pug: user provided objects as input to pug templates can achieve remote code execution

Published Modified CWE 74, 94
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
GHSA6.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Red Hat9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (medium), Red Hat (medium).

Description

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

Affected packages and fixed versions

SourcePackageFixed in
chainguardcode-server, commercial-gitlab-rails-ee-19.2, commercial-gitlab-rails-ee-19.3 and 38 more0
npm::GitHub Security Advisory npmpug, pug-code-gen3.0.1 and 1 more
wolficode-server0
Show all 44 entries from 3 sources
SourcePackageFixed in
chainguardcode-server0
chainguardcommercial-gitlab-rails-ee-19.20
chainguardcommercial-gitlab-rails-ee-19.30
chainguardcommercial-gitlab-rails-ee-19.40
chainguardcommercial-gitlab-rails-ee-fips-19.20
chainguardcommercial-gitlab-rails-ee-fips-19.30
chainguardcommercial-gitlab-rails-ee-fips-19.40
chainguardgitlab-rails-ce-18.10
chainguardgitlab-rails-ce-18.100
chainguardgitlab-rails-ce-18.110
chainguardgitlab-rails-ce-18.20
chainguardgitlab-rails-ce-18.30
chainguardgitlab-rails-ce-18.40
chainguardgitlab-rails-ce-18.50
chainguardgitlab-rails-ce-18.60
chainguardgitlab-rails-ce-18.70
chainguardgitlab-rails-ce-18.80
chainguardgitlab-rails-ce-18.90
chainguardgitlab-rails-ce-19.00
chainguardgitlab-rails-ce-19.10
chainguardgitlab-rails-ce-19.20
chainguardgitlab-rails-ce-19.30
chainguardgitlab-rails-ce-19.40
chainguardgitlab-rails-ce-19.50
chainguardgitlab-rails-ce-fips-18.10
chainguardgitlab-rails-ce-fips-18.100
chainguardgitlab-rails-ce-fips-18.110
chainguardgitlab-rails-ce-fips-18.20
chainguardgitlab-rails-ce-fips-18.30
chainguardgitlab-rails-ce-fips-18.40
chainguardgitlab-rails-ce-fips-18.50
chainguardgitlab-rails-ce-fips-18.60
chainguardgitlab-rails-ce-fips-18.70
chainguardgitlab-rails-ce-fips-18.80
chainguardgitlab-rails-ce-fips-18.90
chainguardgitlab-rails-ce-fips-19.00
chainguardgitlab-rails-ce-fips-19.10
chainguardgitlab-rails-ce-fips-19.20
chainguardgitlab-rails-ce-fips-19.30
chainguardgitlab-rails-ce-fips-19.40
chainguardgitlab-rails-ce-fips-19.50
npm::GitHub Security Advisory npmpug3.0.1
npm::GitHub Security Advisory npmpug-code-gen2.0.3, 3.0.2
wolficode-server0

References

All 10 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.