« Volver al listado

CVE-2024-38526

Estado: AplazadaAlta (7.2)—

pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Pdoc — PdocAIPolyfill — Polyfill.ioAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-38526",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-38526",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-14T14:23:46.307681Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "mitmproxy",
          "product": "pdoc",
          "versions": [
            {
              "status": "affected",
              "version": "< 14.5.1"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:mitmproxy:pdoc:*:*:*:*:*:*:*:*"
          ],
          "vendor": "mitmproxy",
          "product": "pdoc",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "14.5.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-26T00:15:10.703",
  "references": [
    {
      "url": "https://github.com/mitmproxy/pdoc/pull/703",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://sansec.io/research/polyfill-supply-chain-attack",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/mitmproxy/pdoc/pull/703",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://sansec.io/research/polyfill-supply-chain-attack",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1."
    },
    {
      "lang": "es",
      "value": "pdoc proporciona documentación API para proyectos Python. Documentación generada con `pdoc --math` vinculada a archivos JavaScript de polyfill.io. El CDN polyfill.io se vendió y ahora contiene código malicioso. Este problema se solucionó en pdoc 14.5.1."
    }
  ],
  "lastModified": "2026-06-17T07:40:28.397",
  "sourceIdentifier": "security-advisories@github.com"
}