{"id":"CVE-2024-36361","aliases":["AIKIDO-2024-10105","CLSA-2026-1777250300","CLSA-2026-1786620685","EUVD-2024-1383","GHSA-3965-hpx2-q597","ROOT-APP-NPM-AIKIDO-2024-10105","ROOT-APP-NPM-CVE-2024-36361"],"status":"disputed","title":"Pug allows JavaScript code execution if an application accepts untrusted input","description":"Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00491,"percentile":0.42654,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2024-05-24T06:04:19Z","modified":"2026-10-30T19:45:54Z","fixes":[{"ecosystem":"npm","package":"pug","fixed_in":["3.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"npm","package":"pug-code-gen","fixed_in":["3.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"pug-code-gen","fixed_in":["2.0.2-tuxcare.5"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/pug","fixed_in":["2.0.4-root.io.1","2.0.4-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"pug","fixed_in":["2.0.4-aikido.1","2.0.4-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"pug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.2"},{"fixed":"3.0.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"pug-code-gen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.0.2"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"pug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.4-tuxcare.0"},{"fixed":"2.0.4-tuxcare.4"}]}],"versions":["2.0.4","2.0.4-tuxcare.1","2.0.4-tuxcare.2","2.0.4-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"pug-code-gen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2-tuxcare.0"},{"fixed":"2.0.2-tuxcare.5"}]}],"versions":["2.0.2","2.0.2-tuxcare.1","2.0.2-tuxcare.2","2.0.2-tuxcare.3","2.0.2-tuxcare.4"]},{"source":"osv","ecosystem":"npm","package":"pug-code-gen","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"npm","package":"pug","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/pug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-root.io.1"},{"fixed":"2.0.4-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"pug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-aikido.1"},{"fixed":"2.0.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/pug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"pug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-aikido.2"}]}]}],"products":[{"vendor":"pugjs","product":"pug"}],"references":[{"url":"https://github.com/pugjs/pug/pull/3428","tags":["x_transferred","fix","web"]},{"url":"https://pugjs.org/api/reference.html","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36361","tags":["advisory"]},{"url":"https://github.com/Coding-Competition-Team/hackac-2024/tree/main/web/pug","tags":["web"]},{"url":"https://github.com/pugjs/pug/blob/4767cafea0af3d3f935553df0f9a8a6e76d470c2/packages/pug/lib/index.js#L328","tags":["web"]},{"url":"https://www.npmjs.com/package/pug-code-gen","tags":["web"]},{"url":"https://github.com/pugjs/pug/pull/3438","tags":["web"]},{"url":"https://github.com/pugjs/pug/commit/32acfe8f197dc44c54e8af32c7d7b19aa9d350fb","tags":["web"]},{"url":"https://github.com/pugjs/pug/releases/tag/pug%403.0.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3965-hpx2-q597"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36361.json","tags":["advisory"]},{"url":"https://github.com/pugjs/pug","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-36361","description":"Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.","status":"disputed","published":"2024-05-24T06:04:19.211Z","modified":"2025-02-13T15:59:18.755Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-1383","description":"Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.","status":"published","published":"2024-05-24T06:04:19Z","modified":"2025-02-13T15:59:18Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T00:03:53.726571Z"}],"ghsa":[{"id":"GHSA-3965-hpx2-q597","title":"Pug allows JavaScript code execution if an application accepts untrusted input","description":"Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the `compileClient`, `compileFileClient`, or `compileClientWithDependenciesTracked` function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.","status":"published","published":"2024-05-24T14:45:02Z","modified":"2025-04-28T14:20:51Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:38:41.402125Z"}],"nvd":[{"id":"CVE-2024-36361","description":"Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.","status":"disputed","published":"2024-05-24T06:15:08.947Z","modified":"2026-06-17T07:36:34.587Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:10:02.520903Z"}],"osv":[{"id":"CVE-2024-36361","description":"Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.","status":"published","published":"2024-05-24T06:04:19.211Z","modified":"2026-10-28T02:30:51.451581819Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:40.704083Z"},{"id":"GHSA-3965-hpx2-q597","title":"Pug allows JavaScript code execution if an application accepts untrusted input","description":"Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the `compileClient`, `compileFileClient`, or `compileClientWithDependenciesTracked` function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.","status":"published","published":"2024-05-24T14:45:02Z","modified":"2026-09-10T03:50:13.109375625Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"CLSA-2026-1777250300","title":"TuxCare security update for pug (2 CVEs)","description":"TuxCare rebuilt pug to address 2 CVEs. Fixed in 2.0.4-tuxcare.4.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-30T19:45:54.349637721Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1786620685","title":"TuxCare security update for pug-code-gen (2 CVEs)","description":"TuxCare rebuilt pug-code-gen to address 2 CVEs. Fixed in 2.0.2-tuxcare.5.","status":"published","published":"2026-08-13T11:31:25Z","modified":"2026-10-15T09:46:01.60842937Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"ROOT-APP-NPM-AIKIDO-2024-10105","title":"AIKIDO-2024-10105 in @rootio/pug - Patched by Root","description":"Root has patched AIKIDO-2024-10105 in the @rootio/pug package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-16T06:13:17Z","modified":"2026-07-16T13:00:10.091419325Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"ROOT-APP-NPM-CVE-2024-36361","title":"CVE-2024-36361 in @rootio/pug - Patched by Root","description":"Root has patched CVE-2024-36361 in the @rootio/pug package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-16T06:13:17Z","modified":"2026-07-16T13:00:15.835226432Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}