PyPI/pdoc CVE-2024-38526: high 7.2, EPSS 3.83%
pdoc embeds link to malicious CDN if math mode is enabled
Action: Upgrade pdoc to 14.5.1 or later.
pip install pdoc==14.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 14.5.1 | - |
Fixed versions
| 14.5.1 |
Sources
- osv: GHSA-5vgj-ggm4-fg62
- https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62
- https://nvd.nist.gov/vuln/detail/CVE-2024-38526
- https://github.com/mitmproxy/pdoc/pull/703
- https://github.com/mitmproxy/pdoc/commit/726b8f2e365fe8afeb3604a7c73d19b460395d58
- https://github.com/mitmproxy/pdoc
- https://sansec.io/research/polyfill-supply-chain-attack
- https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526
CVE-2024-38526 · published · modified · JSON