GHSA-fp3m-g5rc-4c28

Stage.js DOM Clobbering vulnerabilty

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-53386

Packages

Ecosystem	Package	Affected	Fixed in
npm	stage-js	<= 0.8.10	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-53386 advisory
https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 web
https://github.com/piqnt/stage.js package
https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159 web