{"id":"CVE-2024-38526","aliases":["EUVD-2024-1935","GHSA-5vgj-ggm4-fg62","PYSEC-2026-1764","SUSE-SU-2025:02037-1","openSUSE-SU-2024:14187-1"],"status":"published","title":"pdoc embeds link to malicious CDN if math mode is enabled","description":"pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.","severity":{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N","level":"none","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03832,"percentile":0.90186,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1395"],"published":"2024-06-25T22:23:30Z","modified":"2026-10-28T02:30:38Z","exploits":[{"source":"pocgithub","id":"padayali-JD/pollyscan","title":"padayali-JD/pollyscan","date":"2025-02-18","url":"https://github.com/padayali-JD/pollyscan"},{"source":"pocgithub","id":"putget/CVE-2024-38526","title":"putget/CVE-2024-38526","date":"2024-09-05","url":"https://github.com/putget/CVE-2024-38526"}],"fixes":[{"ecosystem":"PyPI","package":"pdoc","fixed_in":["14.5.1"],"sources":["ghsa","osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ghc-pandoc","fixed_in":["3.1.11.1-150500.11.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ghc-pandoc","fixed_in":["3.1.11.1-150500.11.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"ghc-pandoc","fixed_in":["3.1.11.1-150500.11.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"netpbm","fixed_in":["11.7.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"pdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.5.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"pdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.5.1"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.3.2","0.4","0.4.1","1.0.0","1.0.1","1.1.0","10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","11.0.0","11.1.0","11.2.0","12.0.0","12.0.1","12.0.2","12.1.0","12.2.0","12.2.1","12.2.2","12.3.0","12.3.1","13.0.0","13.0.1","13.1.0","13.1.1","14.0.0","14.1.0","14.2.0","14.3.0","14.4.0","14.5.0","2.0.0","3.0.0","3.0.1","4.0.0","5.0.0","6.0.0","6.1.0","6.1.1","6.2.0","6.3.0","6.3.1","6.3.2","6.4.0","6.4.1","6.4.2","6.4.3","6.4.4","6.5.0","6.6.0","7.0.0","7.0.1","7.0.2","7.0.3","7.1.0","7.1.1","7.2.0","7.3.0","7.3.1","7.4.0","8.0.0","8.0.1","8.1.0","8.2.0","8.3.0","9.0.0","9.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"pdoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.5.1"}]}],"versions":["0.0.1","0.0.10","0.0.11","0.0.12","0.0.13","0.0.14","0.0.15","0.0.16","0.0.17","0.0.18","0.0.19","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7","0.1.8","0.2.0","0.2.1","0.2.2","0.2.3","0.2.4","0.3.0","0.3.1","0.3.2","0.4","0.4.1","1.0.0","1.0.1","1.1.0","10.0.0","10.0.1","10.0.2","10.0.3","10.0.4","11.0.0","11.1.0","11.2.0","12.0.0","12.0.1","12.0.2","12.1.0","12.2.0","12.2.1","12.2.2","12.3.0","12.3.1","13.0.0","13.0.1","13.1.0","13.1.1","14.0.0","14.1.0","14.2.0","14.3.0","14.4.0","14.5.0","2.0.0","3.0.0","3.0.1","4.0.0","5.0.0","6.0.0","6.1.0","6.1.1","6.2.0","6.3.0","6.3.1","6.3.2","6.4.0","6.4.1","6.4.2","6.4.3","6.4.4","6.5.0","6.6.0","7.0.0","7.0.1","7.0.2","7.0.3","7.1.0","7.1.1","7.2.0","7.3.0","7.3.1","7.4.0","8.0.0","8.0.1","8.1.0","8.2.0","8.3.0","9.0.0","9.0.1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"ghc-pandoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11.1-150500.11.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"ghc-pandoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11.1-150500.11.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"ghc-pandoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.11.1-150500.11.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"netpbm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.7.0-1.1"}]}]}],"products":[{"vendor":"mitmproxy","product":"pdoc"}],"references":[{"url":"https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/mitmproxy/pdoc/pull/703","tags":["x_refsource_MISC","x_transferred","fix","web"]},{"url":"https://sansec.io/research/polyfill-supply-chain-attack","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526","tags":["x_transferred","web"]},{"url":"https://github.com/mitmproxy/pdoc/commit/726b8f2e365fe8afeb3604a7c73d19b460395d58","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38526","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5vgj-ggm4-fg62","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38526.json","tags":["advisory"]},{"url":"https://github.com/mitmproxy/pdoc","tags":["package"]},{"url":"https://pypi.org/project/pdoc","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502037-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1227690","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38526","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-38526","title":"pdoc embeds link to malicious CDN if math mode is enabled","description":"pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.","status":"published","published":"2024-06-25T23:53:54.677Z","modified":"2025-02-13T17:53:15.493Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N","level":"none","assessor":"cna"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T14:34:16.367792Z"}],"euvd":[{"id":"EUVD-2024-1935","description":"pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.","status":"published","published":"2024-06-25T23:53:54Z","modified":"2025-02-13T17:53:15Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N","level":"none"}],"updated_at":"2026-11-02T20:53:31.305109Z"}],"ghsa":[{"id":"GHSA-5vgj-ggm4-fg62","title":"pdoc embeds link to malicious CDN if math mode is enabled","description":"### Impact\n\nDocumentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.\nThe polyfill.io CDN has been sold and now serves malicious code.\n\nUsers who produce documentation with math mode should update immediately. All other users are unaffected.\n\n### Patches\n\nThis issue has been fixed in pdoc 14.5.1.\n\n### References\n\nhttps://github.com/mitmproxy/pdoc/pull/703\nhttps://sansec.io/research/polyfill-supply-chain-attack\n\n### Timeline\n\n- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published.\n- **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz.\n- **[2024-06-25 21:33 UTC]** Patched version released.\n- **[2024-06-25 21:37 UTC]** Security advisory published.\n- **[2024-06-25 23:49 UTC]** CVE-2024-38526 assigned by GitHub.","status":"published","published":"2024-06-25T22:23:30Z","modified":"2024-07-26T21:36:48Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T14:37:56.530214Z"}],"nvd":[{"id":"CVE-2024-38526","description":"pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.","status":"published","published":"2024-06-26T00:15:10.703Z","modified":"2026-06-17T07:40:28.397Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"CVE-2024-38526","title":"pdoc embeds link to malicious CDN if math mode is enabled","description":"pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.","status":"published","published":"2024-06-25T23:53:54.677Z","modified":"2026-10-28T02:30:38.043907417Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N","level":"high"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:44:41.133403Z"},{"id":"GHSA-5vgj-ggm4-fg62","title":"pdoc embeds link to malicious CDN if math mode is enabled","description":"### Impact\n\nDocumentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.\nThe polyfill.io CDN has been sold and now serves malicious code.\n\nUsers who produce documentation with math mode should update immediately. All other users are unaffected.\n\n### Patches\n\nThis issue has been fixed in pdoc 14.5.1.\n\n### References\n\nhttps://github.com/mitmproxy/pdoc/pull/703\nhttps://sansec.io/research/polyfill-supply-chain-attack\n\n### Timeline\n\n- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published.\n- **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz.\n- **[2024-06-25 21:33 UTC]** Patched version released.\n- **[2024-06-25 21:37 UTC]** Security advisory published.\n- **[2024-06-25 23:49 UTC]** CVE-2024-38526 assigned by GitHub.","status":"published","published":"2024-06-25T22:23:30Z","modified":"2026-07-07T17:57:02.093875031Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:46:38.911014Z"},{"id":"PYSEC-2026-1764","title":"pdoc embeds link to malicious CDN if math mode is enabled","description":"### Impact\n\nDocumentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.\nThe polyfill.io CDN has been sold and now serves malicious code.\n\nUsers who produce documentation with math mode should update immediately. All other users are unaffected.\n\n### Patches\n\nThis issue has been fixed in pdoc 14.5.1.\n\n### References\n\nhttps://github.com/mitmproxy/pdoc/pull/703\nhttps://sansec.io/research/polyfill-supply-chain-attack\n\n### Timeline\n\n- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published.\n- **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz.\n- **[2024-06-25 21:33 UTC]** Patched version released.\n- **[2024-06-25 21:37 UTC]** Security advisory published.\n- **[2024-06-25 23:49 UTC]** CVE-2024-38526 assigned by GitHub.","status":"published","published":"2026-07-07T14:34:35.434298Z","modified":"2026-07-07T17:47:18.155731612Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"openSUSE-SU-2024:14187-1","title":"libnetpbm-devel-11.7.0-1.1 on GA media","description":"These are all security issues fixed in the libnetpbm-devel-11.7.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-14T00:00:00Z","modified":"2026-02-04T03:29:54.851763Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2025:02037-1","title":"Security update for ghc-pandoc","description":"This update for ghc-pandoc fixes the following issues:\n\n- CVE-2024-38526: Fixed Polyfill Supply Chain Attack (bsc#1227690).\n","status":"published","published":"2025-06-20T09:40:16Z","modified":"2026-03-23T04:48:30.824257Z","updated_at":"2026-11-02T15:53:56.647031Z"}]}}