{"id":"CVE-2021-21353","aliases":["CLSA-2026-1777250300","EUVD-2021-0685","GHSA-p493-635q-r6gr","ROOT-APP-NPM-CVE-2021-21353"],"status":"published","title":"Remote code execution in pug","description":"Pug is an npm package which is a high-performance template engine.  In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1.  This advisory applies to multiple pug packages including \"pug\", \"pug-code-gen\".  pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.04269,"percentile":0.91208,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-74","CWE-94"],"published":"2021-03-03T01:50:18Z","modified":"2026-11-04T02:30:58Z","exploits":[{"source":"pocgithub","id":"jinsu9758/PUG-RCE-CVE-2021-21353-POC","title":"jinsu9758/PUG-RCE-CVE-2021-21353-POC","date":"2025-03-29","url":"https://github.com/jinsu9758/PUG-RCE-CVE-2021-21353-POC"}],"fixes":[{"ecosystem":"npm","package":"pug","fixed_in":["3.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"pug-code-gen","fixed_in":["2.0.3","3.0.2"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"pug","fixed_in":["2.0.4-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"pug-code-gen","fixed_in":["2.0.2-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/pug","fixed_in":["2.0.4-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/pug-code-gen","fixed_in":["2.0.2-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"pug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"pug-code-gen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"pug-code-gen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"pug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.4-tuxcare.0"},{"fixed":"2.0.4-tuxcare.4"}]}],"versions":["2.0.4","2.0.4-tuxcare.1","2.0.4-tuxcare.2","2.0.4-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"pug","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.1"}]}]},{"source":"osv","ecosystem":"npm","package":"pug-code-gen","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"pug-code-gen","ranges":[{"type":"SEMVER","events":[{"introduced":"3.0.0"},{"fixed":"3.0.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"pug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"pug-code-gen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/pug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/pug-code-gen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-root.io.1"}]}]}],"products":[{"vendor":"pugjs","product":"pug"},{"vendor":"pugjs","product":"pug-code-gen"}],"references":[{"url":"https://github.com/pugjs/pug/security/advisories/GHSA-p493-635q-r6gr","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/pugjs/pug/issues/3312","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/pugjs/pug/pull/3314","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/pugjs/pug/commit/991e78f7c4220b2f8da042877c6f0ef5a4683be0","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/pugjs/pug/releases/tag/pug%403.0.1","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://www.npmjs.com/package/pug","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","web"]},{"url":"https://www.npmjs.com/package/pug-code-gen","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21353","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-p493-635q-r6gr"}],"sources":{"cve":[{"id":"CVE-2021-21353","title":"Remote code execution in pug","description":"Pug is an npm package which is a high-performance template engine.  In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1.  This advisory applies to multiple pug packages including \"pug\", \"pug-code-gen\".  pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.","status":"published","published":"2021-03-03T01:50:18Z","modified":"2026-11-02T17:59:55.421Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T19:02:29.283836Z"}],"euvd":[{"id":"EUVD-2021-0685","description":"Pug is an npm package which is a high-performance template engine.  In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1.  This advisory applies to multiple pug packages including \"pug\", \"pug-code-gen\".  pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.","status":"published","published":"2021-03-03T01:50:18Z","modified":"2026-11-02T17:59:55Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T05:08:39.228431Z"}],"ghsa":[{"id":"GHSA-p493-635q-r6gr","title":"Remote code execution via the `pretty` option.","description":"### Impact\n\nIf a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend.\n\n### Patches\n\nUpgrade to `pug@3.0.1` or `pug-code-gen@3.0.2` or `pug-code-gen@2.0.3`, which correctly sanitise the parameter.\n\n### Workarounds\n\nIf there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.\n\n### References\n\n\nOriginal report: https://github.com/pugjs/pug/issues/3312\n\n### For more information\n\nIf you believe you have found other vulnerabilities, please **DO NOT** open an issue. Instead, you can follow the instructions in our [Security Policy](https://github.com/pugjs/pug/blob/master/SECURITY.md)","status":"published","published":"2021-03-03T02:03:52Z","modified":"2025-05-28T19:42:37Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T14:38:44.991725Z"}],"nvd":[{"id":"CVE-2021-21353","description":"Pug is an npm package which is a high-performance template engine.  In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1.  This advisory applies to multiple pug packages including \"pug\", \"pug-code-gen\".  pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.","status":"published","published":"2021-03-03T02:15:13.143Z","modified":"2026-11-02T18:18:32.957Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T20:51:29.040079Z"}],"osv":[{"id":"CVE-2021-21353","description":"Pug is an npm package which is a high-performance template engine.  In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1.  This advisory applies to multiple pug packages including \"pug\", \"pug-code-gen\".  pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.","status":"published","published":"2021-03-03T02:15:13.143Z","modified":"2026-11-04T02:30:58.016170748Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-04T02:54:44.889498Z"},{"id":"GHSA-p493-635q-r6gr","title":"Remote code execution via the `pretty` option.","description":"### Impact\n\nIf a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend.\n\n### Patches\n\nUpgrade to `pug@3.0.1` or `pug-code-gen@3.0.2` or `pug-code-gen@2.0.3`, which correctly sanitise the parameter.\n\n### Workarounds\n\nIf there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.\n\n### References\n\n\nOriginal report: https://github.com/pugjs/pug/issues/3312\n\n### For more information\n\nIf you believe you have found other vulnerabilities, please **DO NOT** open an issue. Instead, you can follow the instructions in our [Security Policy](https://github.com/pugjs/pug/blob/master/SECURITY.md)","status":"published","published":"2021-03-03T02:03:52Z","modified":"2026-09-10T03:49:14.371503003Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-74","CWE-94"],"updated_at":"2026-11-02T15:46:52.534897Z"},{"id":"CLSA-2026-1777250300","title":"TuxCare security update for pug (2 CVEs)","description":"TuxCare rebuilt pug to address 2 CVEs. Fixed in 2.0.4-tuxcare.4.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-30T19:45:54.349637721Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"ROOT-APP-NPM-CVE-2021-21353","title":"CVE-2021-21353 in pug - Patched by Root","description":"Root has patched CVE-2021-21353 in the pug package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-08-11T05:38:01Z","modified":"2026-08-11T06:45:04.664565808Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}