CVE-2021-21353

MediumCVSS 6.8

Published: 03/03/2021(UTC)Updated: 02/11/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

4.27%

91th percentile - higher than 91% of all known CVEs

Summary

Pug is a template engine for Node.js. In versions before 3.0.1, if a remote attacker could control the `pretty` option of the Pug compiler (e.g., by spreading a user-provided object into template inputs), they could achieve remote code execution on the Node.js backend. This is fixed in version 3.0.1, with a backported fix for pug-code-gen in version 2.0.3.

Risk Assessment

This vulnerability allows remote code execution, potentially leading to full compromise of the application server. The risk exists only if untrusted input can be passed to the `pretty` compiler option.

Recommendation

Upgrade the pug package to version 3.0.1 or later, and pug-code-gen to 2.0.3. Ensure user-supplied data is not passed directly to compiler options.

Other vulnerabilities in Pug

CVE-2024-36361Medium
Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. These functions compile Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

Original NVD description (English source)

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS