CVE-2024-36361

CVSS 6.8 MEDIUMEPSS 0.5%CWE-94

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 6.8EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

24 may 2024Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Productos afectados

n/a · n/a

Referencias

https://github.com/pugjs/pug/pull/3428 https://pugjs.org/api/reference.html