CVE-2024-53386

Medium CVSS: 4.9

Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Vendor

Piqnt

Product

Stage.js

CWE

CWE-94

Yayın Tarihi

2025-03-03 07:15:34

Güncelleme

2025-06-27 13:01:00

Source Identifier

cve@mitre.org

KEV Date Added

Kategoriler

CWE-94 Stage.js MEDIUM Piqnt 2025

Referanslar

https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159 https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534