Vulnerability · Published May 24, 2024 · Assigned by mitre

CVE-2024-36361

Medium 6.8

In plain English

A medium-severity code injection in the pug package (npm). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	pug	3.0.3	GHSA-3965-hpx2-q597
npm	pug-code-gen	3.0.3	GHSA-3965-hpx2-q597

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References