TI-2021-04453 Aliases CVE-2021-21353 GHSA-p493-635q-r6gr

Remote code execution in pug

MEDIUM 48CWE-74Published 2021-03-03 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94.

Summary

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.04269 91st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial pug (pugjs): 3.0.1pug (npm): 3.0.1+1 more productRed Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pugjs	pug	before 3.0.1	3.0.1	Patch available	CNA
—	pug (npm)	before 3.0.1	3.0.1	Patch available	GHSA-p493-635q-r6gr
—	pug-code-gen (npm)	before 2.0.3	2.0.3	Patch available	GHSA-p493-635q-r6gr
—	pug-code-gen (npm)	3.0.0 to before 3.0.2	3.0.2	Patch available	GHSA-p493-635q-r6gr

pug Vendorpugjs Affected before 3.0.1 Fixed in 3.0.1 Patch available CNA
pug (npm) Vendor— Affected before 3.0.1 Fixed in 3.0.1 Patch available GHSA-p493-635q-r6gr
pug-code-gen (npm) Vendor— Affected before 2.0.3 Fixed in 2.0.3 Patch available GHSA-p493-635q-r6gr
pug-code-gen (npm) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-p493-635q-r6gr

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:pugjs:pug::::::node.js::*	before 3.0.1	Vulnerable	pugjs
cpe:2.3:a:pugjs:pug-code-gen::::::node.js::*	before 2.0.3; 3.0.0 to before 3.0.2	Vulnerable	pugjs

cpe:2.3:a:pugjs:pug:*:*:*:*:*:node.js:*:* Versions before 3.0.1 Vulnerable ·pugjs
cpe:2.3:a:pugjs:pug-code-gen:*:*:*:*:*:node.js:*:* Versions before 2.0.3; 3.0.0 to before 3.0.2 Vulnerable ·pugjs

Remediation

Fix · CNA pug (pugjs) Fixed in 3.0.1
Fix · GHSA-p493-635q-r6gr pug (npm) Fixed in 3.0.1 Advisory →
Fix · GHSA-p493-635q-r6gr pug-code-gen (npm) Fixed in 2.0.3 Advisory →
Fix · GHSA-p493-635q-r6gr pug-code-gen (npm) Fixed in 3.0.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Logging Subsystem for Red Hat OpenShift	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2021-21353
2026-10-03 Alias added: GHSA-p493-635q-r6gr
2026-11-02 CISA SSVC decision points changed

References

Exploit 1

https://github.com/pugjs/pug/issues/3312

Patch 2

Advisory 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences