Junglewise Threat Intelligence

CVE-2024-36361: Pug JavaScript code injection in template compilation options

CVE-2024-36361 · Severity: low · CVSS 3.1 · Published 2024-05-24

Vendors: npm.

Executive brief

Pug, a popular template engine for Node.js, is vulnerable to a security flaw that could allow an attacker to execute malicious code. This occurs when an application incorrectly passes untrusted user input into specific template compilation settings. If exploited, this could lead to a full system compromise or unauthorized access to sensitive data.

Technical details

A code injection vulnerability exists in Pug (formerly Jade) through version 3.0.2. The vulnerability is rooted in the 'pug-code-gen' package, where the 'name' and 'globals' options in functions such as compileClient, compileFileClient, and compileClientWithDependenciesTracked are not properly sanitized. If an attacker can control these options, they can inject arbitrary JavaScript code into the generated template function. While these functions are typically used for internal template compilation, any application exposing these options to user-controlled input is at risk of Remote Code Execution (RCE). The fix, introduced in version 3.0.3, implements regex validation to ensure these options are valid JavaScript identifiers.

Affected products

  • pugjs pug-code-gen <= 3.0.2
  • pugjs pug <= 3.0.2

Timeline

  • 2024-05-24: patched: Version 3.0.3 released to address the vulnerability.
  • 2024-05-24: disclosed: Advisory published via GitHub and NVD.

References