~ / search / GHSA-3mv9-4h5g-vhg3

GHSA-3mv9-4h5g-vhg3

tsup DOM Clobbering vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2024-53384

Packages

EcosystemPackageAffectedFixed in
npm tsup <= 8.3.4 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs_shims.js components

References

External links from the advisory. They lead to third-party sites.