CVE-2024-36361 Overview
CVE-2024-36361 is a code injection vulnerability [CWE-94] affecting Pug template engine versions through 3.0.2. Pug is a widely used JavaScript template engine for Node.js applications. The flaw allows attackers to execute arbitrary JavaScript code when an application passes untrusted input to the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked functions. These functions compile Pug templates into JavaScript, and the vulnerable option is intended for developer-controlled values only. Applications that expose these compilation APIs to user input inherit the risk of arbitrary code execution in the Node.js process.
Critical Impact
Attackers who control the name option passed to Pug compilation functions can execute arbitrary JavaScript code within the host application, leading to full compromise of the server-side runtime.
Affected Products
- Pug template engine versions up to and including 3.0.2
- Node.js applications invoking compileClient with untrusted name input
- Node.js applications invoking compileFileClient or compileClientWithDependenciesTracked with untrusted name input
Discovery Timeline
- 2024-05-24 - CVE-2024-36361 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-36361
Vulnerability Analysis
The vulnerability arises from Pug's client-side template compilation functions. These functions accept a name option used to label the generated JavaScript function. Pug interpolates this value directly into generated JavaScript source without sanitization. An attacker who controls the name value can break out of the identifier context and inject arbitrary JavaScript statements. When the compiled output is executed or evaluated, the injected code runs with the privileges of the Node.js process.
Exploitation requires the application to pass attacker-controlled data into a compilation API that has no legitimate reason to accept untrusted input. Attack complexity is elevated because most applications do not expose these functions to users. However, template-as-a-service platforms, low-code builders, and administrative UIs that render user-supplied templates are realistic targets.
Root Cause
The root cause is improper neutralization of special elements used in generated code [CWE-94]. The name option is embedded verbatim into the compiled JavaScript function definition, treating a string that should be validated as a JavaScript identifier as raw source code.
Attack Vector
The attack vector is network-based when the vulnerable compilation API is reachable through an HTTP endpoint. An attacker submits a crafted name value containing JavaScript syntax that closes the intended identifier context and appends an arbitrary payload. When the application compiles the template and executes the returned function, the injected code runs. See GitHub Pull Request #3428 and the PugJS API Reference for technical details on the affected functions.
Detection Methods for CVE-2024-36361
Indicators of Compromise
- Unexpected child processes spawned by the Node.js runtime hosting the Pug-based application
- Outbound network connections from the application process to unknown destinations following template compilation requests
- Log entries showing unusual values in the name parameter of template compilation requests, including parentheses, semicolons, or backticks
Detection Strategies
- Perform static analysis of application source to locate calls to compileClient, compileFileClient, and compileClientWithDependenciesTracked and verify that the name option is not derived from request input
- Instrument the Pug library or wrap the compilation functions to log and reject name values that do not match a strict JavaScript identifier pattern such as ^[A-Za-z_$][A-Za-z0-9_$]*$
- Review dependency manifests (package.json, package-lock.json) for pug versions at or below 3.0.2
Monitoring Recommendations
- Monitor process trees originating from Node.js workers for shell, scripting, or reconnaissance binaries
- Alert on file writes or modifications inside the application working directory that occur outside deployment windows
- Capture HTTP request bodies and query parameters directed at template rendering endpoints for offline review
How to Mitigate CVE-2024-36361
Immediate Actions Required
- Upgrade the pug package to a version that addresses CVE-2024-36361 as tracked in GitHub Pull Request #3428
- Audit application code paths to confirm that the name option of compileClient, compileFileClient, and compileClientWithDependenciesTracked is never populated from untrusted input
- Remove or restrict any endpoint that exposes Pug client-side compilation to end users
Patch Information
The fix is tracked in the upstream Pug repository via GitHub Pull Request #3428. Application owners should update to the patched release and redeploy affected services. Verify the resolved pug version in package-lock.json after installation.
Workarounds
- Validate the name option against a strict JavaScript identifier allowlist before invoking any Pug compilation function
- Replace direct exposure of client-side compilation APIs with server-side rendering using pug.render or pug.renderFile with fixed templates
- Isolate template compilation workloads in a sandboxed process or container with minimal filesystem and network privileges
# Configuration example
npm ls pug
npm update pug
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.