Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:npm/pug@3.0.3
purl pkg:npm/pug@3.0.3
Vulnerabilities affecting this package (0)
Vulnerability Summary Fixed by
This package is not known to be affected by vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-6413-jwmk-zfc3 Pug allows JavaScript code execution if an application accepts untrusted input Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the `compileClient`, `compileFileClient`, or `compileClientWithDependenciesTracked` function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers. CVE-2024-36361
GHSA-3965-hpx2-q597

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-05T21:43:44.216490+00:00 GHSA Importer Fixing VCID-6413-jwmk-zfc3 https://github.com/advisories/GHSA-3965-hpx2-q597 38.6.0
2026-06-04T16:51:35.212332+00:00 GithubOSV Importer Fixing VCID-6413-jwmk-zfc3 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/05/GHSA-3965-hpx2-q597/GHSA-3965-hpx2-q597.json 38.6.0
2026-06-04T16:21:46.223584+00:00 GitLab Importer Fixing VCID-6413-jwmk-zfc3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/pug/CVE-2024-36361.yml 38.6.0