« Volver al listado

CVE-2024-36361

Estado: AplazadaMedia (6.8)—

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Pugjs — PUGAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-36361",
  "cveTags": [
    {
      "tags": [
        "disputed"
      ],
      "sourceIdentifier": "cve@mitre.org"
    }
  ],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-36361",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-06T15:59:41.616680Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:pugjs:pug:0.0.2:*:*:*:*:node.js:*:*"
          ],
          "vendor": "pugjs",
          "product": "pug",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.2",
              "versionType": "custom",
              "lessThanOrEqual": "3.0.2"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-24T06:15:08.947",
  "references": [
    {
      "url": "https://github.com/pugjs/pug/pull/3428",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://pugjs.org/api/reference.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/pugjs/pug/pull/3428",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://pugjs.org/api/reference.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers."
    },
    {
      "lang": "es",
      "value": "Pug hasta 3.0.2 permite la ejecución de código JavaScript si una aplicación acepta entradas que no son de confianza para la opción de nombre de la función compileClient, compileFileClient o compileClientWithDependenciesTracked. NOTA: estas funciones son para compilar plantillas de Pug en JavaScript y normalmente no habría motivo para permitir llamadas que no sean de confianza."
    }
  ],
  "lastModified": "2026-06-17T07:36:34.587",
  "sourceIdentifier": "cve@mitre.org"
}