-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pug-code-gen | npm | <= 2.0.3 | 3.0.3 |
| pug | npm | <= 3.0.2 | 3.0.3 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from these three functions in the pug package accepting untrusted input for the 'name/templateName' option. They pass this input to pug-code-gen's compilation process without validation. The GitHub advisory explicitly names these functions, and the patch adds identifier validation in pug-code-gen to prevent injection. The functions' purpose (client-side template compilation) and the CWE-94 classification confirm code injection via parameter manipulation.