Security Vulnerability: Global Variables in Pug Templates

[lazytyper]

Pug Version: 3.0.2

Node Version: 18.18.2

Steps to Reproduce:

Test Code:

const pug = require('pug');

global.config = { siteName: 'My Site' };

const testPug = `
p Old Site Name: #{config.siteName}
- config.siteName = 'Hacked Site'
p New Site Name: #{config.siteName}
`;

const compiled = pug.compile(testPug);
console.log(compiled());

Output:

<p>Old Site Name: My Site</p><p>New Site Name: Hacked Site</p>

The config is now persistently modified:

console.log(config);

Ouput:

{ siteName: 'Hacked Site' }

Workaround

To prevent access to the global variables, you can also set them locally to "undefined".

console.log(compiled({ global: undefined, config: undefined }));

Solution

Adding a "use strict"; to the compiled function might also prevent the access to global variables.