pug-code-gen@3.0.2

{
  "id": "0cfae5152f32dae8110df7a09936aab04a70d497e5d35465060f2c90820c4868",
  "url": "https://github.com/pugjs/pug/releases/tag/pug-code-gen%403.0.2",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "pug-code-gen@3.0.2",
    "summary": "This release sanitizes the pretty option to prevent remote code execution when an attacker controls it. Pug users are advised to upgrade.",
    "evidence": "Bug Fixes Sanitise the pretty option (#3314) If a malicious attacker could control the pretty option, it was possible for them to achieve remote code execution on the server rendering the template. All pug users should upgrade as soon as possible, see #3312 for more details.",
    "products": [
      {
        "name": {
          "value": "pug-code-gen",
          "evidence": "pug-code-gen@3.0.2"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.0.2",
            "evidence": "pug-code-gen@3.0.2"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-pugjs-pug",
  "document_id": 22264,
  "published_at": "2021-02-28T18:23:35+00:00"
}