CVE-2021-21353: Remote Code Execution in pug
Summary
CVE-2021-21353: Remote code execution via the pretty option. Affects pug versions < 3.0.1. Fixed in 3.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The pug package is a popular template engine for Node.js applications. It allows developers to write HTML templates using a concise and expressive syntax. The package is widely used in web development projects to generate dynamic HTML content. However, a vulnerability has been discovered in the pug package that could allow remote code execution on the server-side.
Vulnerability Detail
The vulnerability (CVE-2021-21353) arises from the pretty option of the pug compiler. If an attacker can control this option, they can inject malicious code into the pug template, leading to remote code execution on the Node.js backend. This can be achieved by spreading user-provided objects, such as query parameters, into the pug template inputs. The impact of this vulnerability is significant as it allows an attacker to execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, or other malicious activities.
How To Fix
Latest published version: 3.0.4 as of 22 Oct 2026
npm install pug@3.0.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.1
This is the first release that contains the fix.
npm install pug@3.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately upgrade to the patched versions, you can implement a workaround by ensuring that untrusted input is not passed to pug as the pretty option. For example, you can compile templates in advance before applying user input to them. By doing so, you can mitigate the risk of remote code execution.
Conclusion
The CVE-2021-21353 vulnerability in the pug package allows remote code execution on the server-side. To mitigate this vulnerability, it is recommended to upgrade to the patched versions (pug@3.0.1 or pug-code-gen@3.0.2) or implement the provided workaround. Regularly monitoring for vulnerabilities in your software is crucial to ensure the security of your applications. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for pug →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the server-side, potentially leading to unauthorized access, data breaches, or other malicious activities.
You can fix this vulnerability by upgrading to pug version 3.0.1 or pug-code-gen version 3.0.2. These versions include the necessary fixes to prevent remote code execution.
Yes, if you are unable to immediately upgrade, you can mitigate the risk by ensuring that untrusted input is not passed to pug as the pretty option. Compile templates in advance before applying user input to them.
There is no known public exploit for this vulnerability at the moment. However, it is crucial to patch the vulnerability as soon as possible to prevent any potential attacks.
You can find more information about this vulnerability in the original report on GitHub: https://github.com/pugjs/pug/issues/3312
