Every CVE Search/ Get API key

CVE-2024-38999

jrburke requirejs vulnerable to prototype pollution

10.0 CriticalFix available

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.84%Up 0.8 points since Jul 2, 2024
90%50%10%1%

What each source reports

CVE List Score used 10.0

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Record
CVE-2024-38999
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-1321
Updated
2026-11-02
EUVDEUVD-2024-2445 10.0

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Record
EUVD-2024-2445
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-x3m3-4wpv-5vgc 8.9

jrburke requirejs vulnerable to prototype pollution

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Record
GHSA-x3m3-4wpv-5vgc
CVSS 4.0
8.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-1321
Updated
2026-11-02
NVD 10.0

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Record
CVE-2024-38999
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-1321
Updated
2026-11-02
OSVDEBIAN-CVE-2024-38999 10.0

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Record
DEBIAN-CVE-2024-38999
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVGHSA-x3m3-4wpv-5vgc 8.9

jrburke requirejs vulnerable to prototype pollution

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Record
GHSA-x3m3-4wpv-5vgc
CVSS 4.0
8.9 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness
CWE-1321
Updated
2026-11-02
Show 6 moreShow less
OSVOESA-2026-1600 8.6

nodejs-requirejs security update

RequireJS is a JavaScript file and module loader. It is optimized for in-browser use, but it can be used in other JavaScript environments, like Rhino and Node. Using a modular script loader like RequireJS will improve the speed and quality of your code.

Security Fix(es):

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.(CVE-2024-38999)

Record
OESA-2026-1600
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2024-38999 10.0

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Record
UBUNTU-CVE-2024-38999
CVSS 3.1
10.0 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-05
OSVCLSA-2026-1773706623 No score

TuxCare security update for requirejs (1 CVE)

TuxCare rebuilt requirejs to address 1 CVE. Fixed in 2.1.22-tuxcare.1.

Record
CLSA-2026-1773706623
Updated
2026-11-02
OSVCLSA-2026-1774311625 No score

TuxCare security update for requirejs (1 CVE)

TuxCare rebuilt requirejs to address 1 CVE. Fixed in 2.3.6-tuxcare.1.

Record
CLSA-2026-1774311625
Updated
2026-11-02
OSV No score

jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

Record
CVE-2024-38999
Updated
2026-11-02
OSVSUSE-SU-2024:3771-1 No score

Security update for pgadmin4

This update for pgadmin4 fixes the following issues:

  • CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)
  • CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)
  • CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)
  • CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)
  • CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)
  • CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)
  • CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)
  • CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)
  • CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)
  • CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)
Record
SUSE-SU-2024:3771-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
requirejs
npm
 through 2.3.6
2.3.7
requirejs
TuxCare:npm
 2.1.22-tuxcare.0 up to 2.1.22-tuxcare.1, plus listed versions
2.1.22
2.1.22-tuxcare.1
requirejs
TuxCare:npm
 2.3.6-tuxcare.0 up to 2.3.6-tuxcare.1, plus listed versions
2.3.6
2.3.6-tuxcare.1
requirejs
Debian:12
 All versions, plus listed versions
2.3.6+ds+~2.1.34-22.3.6+ds+~2.1.37-12.3.7+ds+~2.1.37-12.3.8+ds+~2.1.37-1
 None known
requirejs
Debian:13
 before 2.3.7+ds+~2.1.37-1
2.3.7+ds+~2.1.37-1
requirejs
Debian:14
 before 2.3.7+ds+~2.1.37-1
2.3.7+ds+~2.1.37-1
requirejs
npm
 before 2.3.7
2.3.7
nodejs-requirejs
openEuler:24.03-LTS
 before 2.1.11-3.oe2403sp3
2.1.11-3.oe2403sp3
nodejs-requirejs
openEuler:24.03-LTS-SP1
 before 2.1.11-3.oe2403sp1
2.1.11-3.oe2403sp1
nodejs-requirejs
openEuler:24.03-LTS-SP2
 before 2.1.11-3.oe2403sp2
2.1.11-3.oe2403sp2
Show 12 moreShow less
Affected packages
PackageAffectedFixed
nodejs-requirejs
openEuler:24.03-LTS-SP3
 before 2.1.11-3.oe2403sp3
2.1.11-3.oe2403sp3
nodejs-requirejs
openEuler:20.03-LTS-SP4
 before 2.1.11-3.oe2003sp4
2.1.11-3.oe2003sp4
nodejs-requirejs
openEuler:22.03-LTS-SP4
 before 2.1.11-3.oe2203sp4
2.1.11-3.oe2203sp4
pgadmin4
SUSE:Linux Enterprise Module for Python 3 15 SP6
From an advisory covering 10 CVEs
 before 8.5-150600.3.6.1
8.5-150600.3.6.1
pgadmin4
openSUSE:Leap 15.6
From an advisory covering 10 CVEs
 before 8.5-150600.3.6.1
8.5-150600.3.6.1
requirejs
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.1.18-12.1.20-12.1.22-1
 None known
requirejs
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.3.2-1
 None known
requirejs
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.3.6-1
 None known
requirejs
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.3.6+ds-1
 None known
requirejs
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.3.6+ds+~2.1.34-2
 None known
requirejs
Ubuntu:25.10
 All versions, plus listed versions
2.3.7+ds+~2.1.37-1
 None known
requirejs
Ubuntu:26.10
 All versions, plus listed versions
2.3.8+ds+~2.1.37-1
 None known

History

History
RecordedChangedSources
affected
affected, factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-38999 is a critical vulnerability (CVSS 10.0) in Jrburke Requirejs, published July 1, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in requirejs 2.3.7.

References

Show 27 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open