{"id":"CVE-2024-38999","aliases":["CLSA-2026-1773706623","CLSA-2026-1774311625","DEBIAN-CVE-2024-38999","EUVD-2024-2445","GHSA-x3m3-4wpv-5vgc","OESA-2026-1600","SUSE-SU-2024:3771-1","UBUNTU-CVE-2024-38999"],"status":"published","title":"jrburke requirejs vulnerable to prototype pollution","description":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00844,"percentile":0.58447,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2024-07-01T00:00:00Z","modified":"2026-11-05T11:45:12Z","fixes":[{"ecosystem":"npm","package":"requirejs","fixed_in":["2.3.7"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"requirejs","fixed_in":["2.1.22-tuxcare.1","2.3.6-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"requirejs","fixed_in":["2.3.7+ds+~2.1.37-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"requirejs","fixed_in":["2.3.7+ds+~2.1.37-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"nodejs-requirejs","fixed_in":["2.1.11-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs-requirejs","fixed_in":["2.1.11-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"nodejs-requirejs","fixed_in":["2.1.11-3.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"nodejs-requirejs","fixed_in":["2.1.11-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs-requirejs","fixed_in":["2.1.11-3.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"nodejs-requirejs","fixed_in":["2.1.11-3.oe2203sp4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.3.6"},{"fixed":"2.3.7"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.22-tuxcare.0"},{"fixed":"2.1.22-tuxcare.1"}]}],"versions":["2.1.22"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.6-tuxcare.0"},{"fixed":"2.3.6-tuxcare.1"}]}],"versions":["2.3.6"]},{"source":"osv","ecosystem":"Debian:12","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.6+ds+~2.1.34-2","2.3.6+ds+~2.1.37-1","2.3.7+ds+~2.1.37-1","2.3.8+ds+~2.1.37-1"]},{"source":"osv","ecosystem":"Debian:13","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7+ds+~2.1.37-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.7+ds+~2.1.37-1"}]}]},{"source":"osv","ecosystem":"npm","package":"requirejs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.3.7"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"nodejs-requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nodejs-requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"nodejs-requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-3.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nodejs-requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nodejs-requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-3.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nodejs-requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.11-3.oe2203sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"pgadmin4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5-150600.3.6.1"}]}],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.18-1","2.1.20-1","2.1.22-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.2-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.6-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.6+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.6+ds+~2.1.34-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.7+ds+~2.1.37-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"requirejs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.8+ds+~2.1.37-1"]}],"products":[{"vendor":"jrburke","product":"requirejs"}],"references":[{"url":"https://gist.github.com/mestrtee/9acae342285bd2998fa09ebcb1e6d30a","tags":["x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38999","tags":["advisory"]},{"url":"https://github.com/requirejs/r.js/issues/1015","tags":["web"]},{"url":"https://github.com/requirejs/requirejs/issues/1854","tags":["web"]},{"url":"https://github.com/requirejs/requirejs/pull/1856/commits/ebd7a2ff71473542fa132d0d15c10fb4ed1539e1","tags":["web"]},{"url":"https://security.snyk.io/vuln/SNYK-JS-REQUIREJS-5416713","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x3m3-4wpv-5vgc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-38999","tags":["advisory"]},{"url":"https://github.com/requirejs/r.js","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-1600","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243771-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1224295","tags":["report"]},{"url":"https://bugzilla.suse.com/1224366","tags":["report"]},{"url":"https://bugzilla.suse.com/1226967","tags":["report"]},{"url":"https://bugzilla.suse.com/1227248","tags":["report"]},{"url":"https://bugzilla.suse.com/1227252","tags":["report"]},{"url":"https://bugzilla.suse.com/1229423","tags":["report"]},{"url":"https://bugzilla.suse.com/1229861","tags":["report"]},{"url":"https://bugzilla.suse.com/1230928","tags":["report"]},{"url":"https://bugzilla.suse.com/1231564","tags":["report"]},{"url":"https://bugzilla.suse.com/1231684","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38355","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-39338","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4067","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-4068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-48949","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9014","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-38999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-38999","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-38999","description":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T00:00:00Z","modified":"2024-08-02T04:19:20.589Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:34:16.367792Z"}],"euvd":[{"id":"EUVD-2024-2445","description":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T00:00:00Z","modified":"2024-08-02T04:19:20Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T03:50:18.462935Z"}],"ghsa":[{"id":"GHSA-x3m3-4wpv-5vgc","title":"jrburke requirejs vulnerable to prototype pollution","description":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function `s.contexts._.configure`. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T15:32:19Z","modified":"2024-08-04T05:05:54Z","cvss":[{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"},{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:37:57.422393Z"}],"nvd":[{"id":"CVE-2024-38999","description":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T13:15:05.28Z","modified":"2026-06-17T07:41:20.473Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:10:09.388795Z"}],"osv":[{"id":"DEBIAN-CVE-2024-38999","description":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T13:15:05.28Z","modified":"2026-11-02T12:02:37.161616099Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:42.835825Z"},{"id":"GHSA-x3m3-4wpv-5vgc","title":"jrburke requirejs vulnerable to prototype pollution","description":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function `s.contexts._.configure`. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T15:32:19Z","modified":"2026-09-10T03:50:16.891512392Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":8.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"OESA-2026-1600","title":"nodejs-requirejs security update","description":"RequireJS is a JavaScript file and module loader. It is optimized for in-browser use, but it can be used in other JavaScript environments, like Rhino and Node. Using a modular script loader like RequireJS will improve the speed and quality of your code.\r\n\r\nSecurity Fix(es):\n\njrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.(CVE-2024-38999)","status":"published","published":"2026-03-15T11:10:36Z","modified":"2026-08-18T01:19:38.039135353Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:45.721983Z"},{"id":"UBUNTU-CVE-2024-38999","description":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T13:15:00Z","modified":"2026-11-05T11:45:12.630197032Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-05T13:30:49.23793Z"},{"id":"CLSA-2026-1773706623","title":"TuxCare security update for requirejs (1 CVE)","description":"TuxCare rebuilt requirejs to address 1 CVE. Fixed in 2.1.22-tuxcare.1.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-15T09:47:47.002014846Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1774311625","title":"TuxCare security update for requirejs (1 CVE)","description":"TuxCare rebuilt requirejs to address 1 CVE. Fixed in 2.3.6-tuxcare.1.","status":"published","published":"2026-08-04T14:52:14Z","modified":"2026-10-20T13:58:24.684089779Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CVE-2024-38999","description":"jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure. This vulnerability allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.","status":"published","published":"2024-07-01T13:15:05Z","modified":"2026-04-10T05:13:32.440108Z","updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"SUSE-SU-2024:3771-1","title":"Security update for pgadmin4","description":"This update for pgadmin4 fixes the following issues:\n\n- CVE-2024-38355: Fixed socket.io: unhandled 'error' event (bsc#1226967)\n- CVE-2024-38998: Fixed requirejs: prototype pollution via function config (bsc#1227248)\n- CVE-2024-38999: Fixed requirejs: prototype pollution via function s.contexts._.configure (bsc#1227252)\n- CVE-2024-39338: Fixed axios: server-side request forgery due to requests for path relative URLs being processed as protocol relative URLs in axios (bsc#1229423)\n- CVE-2024-4067: Fixed micromatch: vulnerable to Regular Expression Denial of Service (ReDoS) (bsc#1224366)\n- CVE-2024-4068: Fixed braces: fails to limit the number of characters it can handle, which could lead to Memory Exhaustion (bsc#1224295)\n- CVE-2024-43788: Fixed webpack: DOM clobbering gadget in AutoPublicPathRuntimeModule could lead to XSS (bsc#1229861)\n- CVE-2024-48948: Fixed elliptic: ECDSA signature verification error due to leading zero may reject legitimate transactions in elliptic (bsc#1231684)\n- CVE-2024-48949: Fixed elliptic: Missing Validation in Elliptic's EDDSA Signature Verification (bsc#1231564)\n- CVE-2024-9014: Fixed OAuth2 issue that could lead to information leak (bsc#1230928)\n","status":"published","published":"2024-10-29T12:55:34Z","modified":"2026-02-04T02:25:55.097314Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}