Security Vulnerability: Global Variables in Pug Templates
Author: lazytyperCreated May 22, 2024Updated Aug 26, 2025
**Pug Version:** 3.0.2
**Node Version:** 18.18.2
## Steps to Reproduce:
### Test Code:
```javascript
const pug = require('pug');
global.config = { siteName: 'My Site' };
const testPug = `
p Old Site Name: #{config.siteName}
- config.siteName = 'Hacked Site'
p New Site Name: #{config.siteName}
`;
const compiled = pug.compile(testPug);
console.log(compiled());
```
### Output:
```html
Old Site Name: My Site
New Site Name: Hacked Site
``` ## The config is now persistently modified: ```javascript console.log(config); ``` ### Ouput: ``` { siteName: 'Hacked Site' } ``` ## Workaround To prevent access to the global variables, you can also set them locally to "undefined". ```javascript console.log(compiled({ global: undefined, config: undefined })); ``` ## Solution Adding a `"use strict";` to the compiled function might also prevent the access to global variables.Source: pugjs/pug