{"id":"CVE-2021-21353","aliases":["GHSA-p493-635q-r6gr"],"url":"https://o3.security/vulnerability/CVE-2021-21353","summary":"Remote code execution via the `pretty` option.","details":"### Impact\n\nIf a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend.\n\n### Patches\n\nUpgrade to `pug@3.0.1` or `pug-code-gen@3.0.2` or `pug-code-gen@2.0.3`, which correctly sanitise the parameter.\n\n### Workarounds\n\nIf there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.\n\n### References\n\n\nOriginal report: https://github.com/pugjs/pug/issues/3312\n\n### For more information\n\nIf you believe you have found other vulnerabilities, please **DO NOT** open an issue. Instead, you can follow the instructions in our [Security Policy](https://github.com/pugjs/pug/blob/master/SECURITY.md)","published":"2021-03-03T02:15:13.143Z","modified":"2026-07-08T06:27:15.636863345Z","cvss":{"score":9,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"pug","fixedVersion":"3.0.1"},{"ecosystem":"npm","name":"pug-code-gen","fixedVersion":"2.0.3"},{"ecosystem":"npm","name":"pug-code-gen","fixedVersion":"3.0.2"}],"fix":{"url":"https://github.com/pugjs/pug/commit/991e78f7c4220b2f8da042877c6f0ef5a4683be0","label":"pugjs/pug@991e78f"},"references":[{"type":"ADVISORY","url":"https://github.com/pugjs/pug/releases/tag/pug%403.0.1"},{"type":"ADVISORY","url":"https://github.com/pugjs/pug/security/advisories/GHSA-p493-635q-r6gr"},{"type":"ADVISORY","url":"https://www.npmjs.com/package/pug"},{"type":"ADVISORY","url":"https://www.npmjs.com/package/pug-code-gen"},{"type":"FIX","url":"https://github.com/pugjs/pug/commit/991e78f7c4220b2f8da042877c6f0ef5a4683be0"},{"type":"FIX","url":"https://github.com/pugjs/pug/issues/3312"},{"type":"FIX","url":"https://github.com/pugjs/pug/pull/3314"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21353"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T06:27:15.636863345Z"}}