Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability has been identified in the Pug template engine, a component used in some Node.js applications. If an attacker can influence a specific setting within the compiler, it may allow them to execute arbitrary code on the backend. This risk is mitigated if untrusted input is not directly passed to the compiler's `pretty` option, such as when templates are pre-compiled.
- Allows attackers to run code on backend servers.
- Matters if user input directly controls compiler settings.
- Confirm if user input affects template compilation.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this vulnerability if they can control the `pretty` option passed to the Pug template compiler. This typically occurs when user-supplied input, such as query parameters from a web request, is directly used in compiling Pug templates on a Node.js backend. Successful exploitation could allow an attacker to execute arbitrary code on the server.
- No special access required.
- User input controls `pretty` option.
- Remote code execution risk.
Live Threat
Current exploitation, exposure, and threat context
When a remote attacker can control the `pretty` option passed to the Pug compiler, such as by manipulating query parameters of a request, it could lead to remote code execution on the Node.js backend. This threat is mitigated if templates are compiled in advance, before user input is processed.
- Node.js backend code execution.
- Remote attacker controls `pretty` option.
- Compromised backend services.
Operational Fix
Recommended remediation, mitigation, and detection steps
System owners and platform teams responsible for Node.js backends should first confirm where Pug is deployed and if untrusted input can reach the `pretty` option. This will determine the actual risk and the need for remediation, which may involve coordination with application development teams or vendor management if the issue lies with a third-party integration. The practical first step is to inventory all Pug instances, assess their exposure and criticality, and identify the accountable owners before planning any updates or mitigation strategies.
- Application and platform teams own remediation.
- Verify untrusted input reaches the `pretty` option.
- Plan remediation based on exposure and criticality.
