CVE-2024-53386
MEDIUM 6.1EPSS 0.2%
Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
- Affected
- Piqnt · Stage.js
- CVSS v3.1 NVD
- 6.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS v3.1 MITRE
- 4.9 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N - EPSS
- 0.25% chance of exploitation in the next 30 days, 15th percentile
- Published
- 2025-03-03
Proof-of-concept exploits (1)
Security advisories
- advisories/GHSA-fp3m-g5rc-4c28
- piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159