Every CVE Search/ Get API key

CVE-2024-38526

pdoc embeds link to malicious CDN if math mode is enabled

0.0 NonePublic exploitFix available

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
Low

Exploit likelihood

3.83%Up 3.8 points since Jun 26, 2024
90%50%10%1%

What each source reports

CVE List Score used 0.0

pdoc embeds link to malicious CDN if math mode is enabled

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.

Record
CVE-2024-38526
CVSS 3.1
0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N
Weakness
CWE-1395
Updated
2026-11-02
EUVDEUVD-2024-1935 0.0

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.

Record
EUVD-2024-1935
CVSS 3.1
0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-5vgj-ggm4-fg62 7.2

pdoc embeds link to malicious CDN if math mode is enabled

Impact

Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code.

Users who produce documentation with math mode should update immediately. All other users are unaffected.

Patches

This issue has been fixed in pdoc 14.5.1.

References

https://github.com/mitmproxy/pdoc/pull/703 https://sansec.io/research/polyfill-supply-chain-attack

Timeline

  • [2024-06-25] https://sansec.io/research/polyfill-supply-chain-attack is published.
  • [2024-06-25 20:54 UTC] Issue reported to the pdoc project by @adhintz.
  • [2024-06-25 21:33 UTC] Patched version released.
  • [2024-06-25 21:37 UTC] Security advisory published.
  • [2024-06-25 23:49 UTC] CVE-2024-38526 assigned by GitHub.
Record
GHSA-5vgj-ggm4-fg62
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
Updated
2026-11-02
NVD 7.2

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.

Record
CVE-2024-38526
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
Updated
2026-11-02
OSV 7.2

pdoc embeds link to malicious CDN if math mode is enabled

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.

Record
CVE-2024-38526
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N
Weakness
CWE-1395
Updated
2026-11-02
OSVGHSA-5vgj-ggm4-fg62 7.2

pdoc embeds link to malicious CDN if math mode is enabled

Impact

Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code.

Users who produce documentation with math mode should update immediately. All other users are unaffected.

Patches

This issue has been fixed in pdoc 14.5.1.

References

https://github.com/mitmproxy/pdoc/pull/703 https://sansec.io/research/polyfill-supply-chain-attack

Timeline

  • [2024-06-25] https://sansec.io/research/polyfill-supply-chain-attack is published.
  • [2024-06-25 20:54 UTC] Issue reported to the pdoc project by @adhintz.
  • [2024-06-25 21:33 UTC] Patched version released.
  • [2024-06-25 21:37 UTC] Security advisory published.
  • [2024-06-25 23:49 UTC] CVE-2024-38526 assigned by GitHub.
Record
GHSA-5vgj-ggm4-fg62
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
Updated
2026-11-02
OSVPYSEC-2026-1764 7.2

pdoc embeds link to malicious CDN if math mode is enabled

Impact

Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code.

Users who produce documentation with math mode should update immediately. All other users are unaffected.

Patches

This issue has been fixed in pdoc 14.5.1.

References

https://github.com/mitmproxy/pdoc/pull/703 https://sansec.io/research/polyfill-supply-chain-attack

Timeline

  • [2024-06-25] https://sansec.io/research/polyfill-supply-chain-attack is published.
  • [2024-06-25 20:54 UTC] Issue reported to the pdoc project by @adhintz.
  • [2024-06-25 21:33 UTC] Patched version released.
  • [2024-06-25 21:37 UTC] Security advisory published.
  • [2024-06-25 23:49 UTC] CVE-2024-38526 assigned by GitHub.
Record
PYSEC-2026-1764
CVSS 3.1
7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2024:14187-1 No score

libnetpbm-devel-11.7.0-1.1 on GA media

These are all security issues fixed in the libnetpbm-devel-11.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14187-1
Updated
2026-11-02
OSVSUSE-SU-2025:02037-1 No score

Security update for ghc-pandoc

This update for ghc-pandoc fixes the following issues:

  • CVE-2024-38526: Fixed Polyfill Supply Chain Attack (bsc#1227690).
Record
SUSE-SU-2025:02037-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pdoc
PyPI
 before 14.5.1
14.5.1
pdoc
PyPI
 before 14.5.1, plus listed versions
0.0.10.0.100.0.110.0.120.0.13
Show 45 moreShow less
0.0.140.0.150.0.160.0.170.0.180.0.190.0.20.0.30.0.40.0.50.0.60.0.70.0.80.0.90.1.00.1.10.1.20.1.30.1.40.1.50.1.60.1.70.1.80.2.00.2.10.2.20.2.30.2.40.3.00.3.10.3.20.40.4.11.0.01.0.11.1.010.0.010.0.110.0.210.0.310.0.411.0.011.1.011.2.012.0.0
14.5.1
ghc-pandoc
SUSE:Linux Enterprise Module for Package Hub 15 SP6
 before 3.1.11.1-150500.11.6.1
3.1.11.1-150500.11.6.1
ghc-pandoc
SUSE:Linux Enterprise Module for Package Hub 15 SP7
 before 3.1.11.1-150500.11.6.1
3.1.11.1-150500.11.6.1
ghc-pandoc
openSUSE:Leap 15.6
 before 3.1.11.1-150500.11.6.1
3.1.11.1-150500.11.6.1
netpbm
openSUSE:Tumbleweed
 before 11.7.0-1.1
11.7.0-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubpadayali-JD/pollyscan2025-02-18
PoC in GitHubputget/CVE-2024-385262024-09-05

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38526 is a none vulnerability (CVSS 0.0) in Mitmproxy Pdoc, published June 25, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.83%, the 90th percentile. Fixed in pdoc 14.5.1.

References

Show 7 moreShow less
This page doesn't list everything

Left out here: 54 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open