# CVE-2021-21353: Remote code execution in pug

Status: published. Published: 2021-03-03. Updated: 2026-11-02.

Pug is an npm package which is a high-performance template engine.  In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1.  This advisory applies to multiple pug packages including "pug", "pug-code-gen".  pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

## Remediation

- fix: pug (npm): OSV reports a fixed version 3.0.1. Check the advisory for supported release branches. (source: OSV GHSA-p493-635q-r6gr) — https://github.com/advisories/GHSA-p493-635q-r6gr
- fix: pug-code-gen (npm): OSV reports a fixed version 2.0.3. Check the advisory for supported release branches. (source: OSV GHSA-p493-635q-r6gr) — https://github.com/advisories/GHSA-p493-635q-r6gr
- fix: pug-code-gen (npm): OSV reports a fixed version 3.0.2. Check the advisory for supported release branches. (source: OSV GHSA-p493-635q-r6gr) — https://github.com/advisories/GHSA-p493-635q-r6gr

## Affected products and versions

- pugjs / pug: < 3.0.1 (affected). Source: CNA: GitHub_M
-  / pug (pug): ≥ 0; < 3.0.1 (affected, semver); OSV events: introduced 0; fixed 3.0.1. Source: OSV GHSA-p493-635q-r6gr
-  / pug-code-gen (pug-code-gen): ≥ 0; < 2.0.3 (affected, semver); OSV events: introduced 0; fixed 2.0.3. Source: OSV GHSA-p493-635q-r6gr
-  / pug-code-gen (pug-code-gen): ≥ 3.0.0; < 3.0.2 (affected, semver); OSV events: introduced 3.0.0; fixed 3.0.2. Source: OSV GHSA-p493-635q-r6gr

## Severity and prioritization

- CVSS 3.1: 6.8 (medium); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N; source: CNA: GitHub_M

- CISA KEV: No listing in collected sources

- EPSS: 4.30% as of 2026-11-02; percentile 91.15%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-74

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/pugjs/pug/security/advisories/GHSA-p493-635q-r6gr (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/pugjs/pug/issues/3312 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/pugjs/pug/pull/3314 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/pugjs/pug/commit/991e78f7c4220b2f8da042877c6f0ef5a4683be0 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/pugjs/pug/releases/tag/pug%403.0.1 (CNA: GitHub_M; x_refsource_MISC)

- https://www.npmjs.com/package/pug (CNA: GitHub_M; x_refsource_MISC)

- https://www.npmjs.com/package/pug-code-gen (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/pugjs/pug/security/advisories/GHSA-p493-635q-r6gr (ADP: CVE; x_refsource_CONFIRM, x_transferred)

- https://github.com/pugjs/pug/issues/3312 (ADP: CVE; x_refsource_MISC, x_transferred)

- https://github.com/pugjs/pug/pull/3314 (ADP: CVE; x_refsource_MISC, x_transferred)

- https://github.com/pugjs/pug/commit/991e78f7c4220b2f8da042877c6f0ef5a4683be0 (ADP: CVE; x_refsource_MISC, x_transferred)

- https://github.com/pugjs/pug/releases/tag/pug%403.0.1 (ADP: CVE; x_refsource_MISC, x_transferred)

- https://www.npmjs.com/package/pug (ADP: CVE; x_refsource_MISC, x_transferred)

- https://www.npmjs.com/package/pug-code-gen (ADP: CVE; x_refsource_MISC, x_transferred)

- https://github.com/advisories/GHSA-p493-635q-r6gr (OSV / GitHub Security Advisories; advisory)

- https://osv.dev/vulnerability/GHSA-p493-635q-r6gr (OSV / GitHub Security Advisories; osv)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2021-21353; retrieved 2026-11-02; source updated 2026-11-02

- OSV / GitHub Security Advisories: https://osv.dev/vulnerability/GHSA-p493-635q-r6gr; retrieved 2026-11-02; source updated 2026-09-10

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2021-21353; retrieved 2026-11-02; source updated Not reported

Revision: 8df98c62d4e85f7b1523698a69093a275bfad0c4031517f4bc6f55b38b0c5fc2

Canonical: https://y2.dev/cve/CVE-2021-21353

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.