pug@3.0.3

{
  "id": "1a470bc20dd0249b0791aa7f62d073deb1efb92a1a4ea8df62e6b229f1384f72",
  "url": "https://github.com/pugjs/pug/releases/tag/pug%403.0.3",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "pug@3.0.3",
    "summary": "Pug 3.0.3 updates pug-code-gen to validate templateName and globals as JavaScript identifiers, preventing possible remote code execution when untrusted input is passed to compilation options.",
    "evidence": "Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options",
    "products": [
      {
        "name": {
          "value": "pug",
          "evidence": "pug@3.0.3"
        },
        "prerequisites": [
          {
            "value": "un-trusted user input is passed to the compilation options",
            "evidence": "if un-trusted user input is passed to the compilation options"
          }
        ],
        "fixed_versions": [
          {
            "value": "3.0.3",
            "evidence": "pug@3.0.3"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-pugjs-pug",
  "document_id": 22262,
  "published_at": "2024-05-24T17:35:06+00:00"
}