PyPI/ethyca-fides CVE-2024-38537: unknown 0, EPSS 1.43%
Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js
Action: Upgrade ethyca-fides to 2.39.1 or later.
pip install ethyca-fides==2.39.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.39.1 | - |
Fixed versions
| 2.39.1 |
Sources
- osv: PYSEC-2026-1339
- https://github.com/ethyca/fides/security/advisories/GHSA-cvw4-c69g-7v7m
- https://nvd.nist.gov/vuln/detail/CVE-2024-38537
- https://github.com/ethyca/fides/pull/5026
- https://github.com/ethyca/fides/commit/868c4d629760572192bd61db34f5a4458ed12005
- https://fetch.spec.whatwg.org
- https://github.com/ethyca/fides
- https://sansec.io/research/polyfill-supply-chain-attack
- https://pypi.org/project/ethyca-fides
- https://github.com/advisories/GHSA-cvw4-c69g-7v7m
CVE-2024-38537 · published · modified · JSON