Update dependency pug to v3.0.3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pug (source)	3.0.1 → 3.0.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Pug allows JavaScript code execution if an application accepts untrusted input

CVE-2024-36361 / GHSA-3965-hpx2-q597

More information

Details

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would typically be no reason to allow untrusted callers.

Severity

• CVSS Score: 6.8 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-36361
• https://github.com/pugjs/pug/pull/3428
• https://github.com/Coding-Competition-Team/hackac-2024/tree/main/web/pug
• https://github.com/pugjs/pug/blob/4767cafea0af3d3f935553df0f9a8a6e76d470c2/packages/pug/lib/index.js#L328
• https://pugjs.org/api/reference.html
• https://www.npmjs.com/package/pug-code-gen
• https://github.com/pugjs/pug/pull/3438
• https://github.com/pugjs/pug/commit/32acfe8f197dc44c54e8af32c7d7b19aa9d350fb
• https://github.com/pugjs/pug/releases/tag/pug%403.0.3
• https://github.com/advisories/GHSA-3965-hpx2-q597

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pugjs/pug (pug)

v3.0.3

Compare Source

Bug Fixes

• Update pug-code-gen with the following fix: (#​3438)

  Validate templateName and globals are valid JavaScript identifiers to prevent possible remote code execution if un-trusted user input is passed to the compilation options

v3.0.2

Compare Source

Bug Fixes

• Sanitise the pretty option (#​3314)

  If a malicious attacker could control the pretty option, it was possible for them to achieve remote code execution on the server rendering the template. All pug users should upgrade as soon as possible, see #​3312 for more details.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.