Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2021-21353

30
FAUCET Score

CVE-2021-21353 is a critical remote code execution (RCE) vulnerability affecting the Pug template engine (npm packages "pug" and "pug-code-gen") versions prior to 3.0.1 and 2.0.3 respectively. An attacker can achieve RCE by manipulating the 'pretty' option of the Pug compiler if user-controlled input is spread into template inputs. This vulnerability has a CVSS score of 9.0 (CRITICAL) due to its network attack vector, high impact on confidentiality, integrity, and availability, and low attack complexity. While no active exploitation, public exploits, or significant community discussion have been observed, organizations using affected Pug versions should upgrade to mitigate this severe risk.

Impacted Technologies

VendorProductVersion(s)CPE
< 3.0.1CPE matchmatch criteria
cpe:2.3:a:pugjs:pug:*:*:*:*:*:node.js:*:*
< 2.0.3CPE matchmatch criteria
cpe:2.3:a:pugjs:pug-code-gen:*:*:*:*:*:node.js:*:*
>= 3.0.0, < 3.0.2CPE matchmatch criteria
cpe:2.3:a:pugjs:pug-code-gen:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

6.8MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
Exploitability Score
2.2
Impact Score
4.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
4.27%
Probability of exploitation in next 30 days
EPSS Percentile
90.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0427 is in the 87th percentile among its peer group of 201 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.4 Reddit, 1.3 Bluesky, 0.9 Mastodon, and 2.3 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.8 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: pugFixed in: 3.0.1
npmpatch availablevia ghsa
Product: pug-code-genFixed in: 2.0.3
npmpatch availablevia ghsa
Product: pug-code-genFixed in: 3.0.2
redhatno patchvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: openshift-logging/kibana6-rhel8

Vendor Advisories (2)

npmGHSA-p493-635q-r6grmedium

Remote code execution via the `pretty` option.

Mar 3, 2021
redhatCVE-2021-21353Moderate

pug: user provided objects as input to pug templates can achieve remote code execution

Feb 28, 2021

References

github.com / pugjs/pug/commit/991e78f7c4220b2f8da042877c6f0ef5a4683be0
PatchThird Party Advisory
github.com / pugjs/pug/issues/3312
ExploitPatchThird Party Advisory
github.com / pugjs/pug/pull/3314
PatchThird Party Advisory
github.com / pugjs/pug/releases/tag/pug%403.0.1
Release NotesThird Party Advisory
github.com / pugjs/pug/security/advisories/GHSA-p493-635q-r6gr
Third Party Advisory
npmjs.com / package/pug
ProductThird Party Advisory
npmjs.com / package/pug-code-gen
ProductThird Party Advisory