{"id":"CVE-2024-38526","aliases":["GHSA-5vgj-ggm4-fg62","PYSEC-2026-1764"],"url":"https://o3.security/vulnerability/CVE-2024-38526","summary":"pdoc embeds link to malicious CDN if math mode is enabled","details":"### Impact\n\nDocumentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.\nThe polyfill.io CDN has been sold and now serves malicious code.\n\nUsers who produce documentation with math mode should update immediately. All other users are unaffected.\n\n### Patches\n\nThis issue has been fixed in pdoc 14.5.1.\n\n### References\n\nhttps://github.com/mitmproxy/pdoc/pull/703\nhttps://sansec.io/research/polyfill-supply-chain-attack\n\n### Timeline\n\n- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published.\n- **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz.\n- **[2024-06-25 21:33 UTC]** Patched version released.\n- **[2024-06-25 21:37 UTC]** Security advisory published.\n- **[2024-06-25 23:49 UTC]** CVE-2024-38526 assigned by GitHub.","published":"2024-06-25T23:53:54.677Z","modified":"2026-10-28T02:30:38.043907417Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L/E:H/RL:O/RC:C/MC:N/MI:N/MA:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"pdoc","fixedVersion":"14.5.1"}],"fix":{"url":"https://github.com/mitmproxy/pdoc/pull/703","label":"mitmproxy/pdoc#703"},"references":[{"type":"WEB","url":"https://sansec.io/research/polyfill-supply-chain-attack"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38526.json"},{"type":"ADVISORY","url":"https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38526"},{"type":"FIX","url":"https://github.com/mitmproxy/pdoc/pull/703"},{"type":"WEB","url":"https://github.com/mitmproxy/pdoc/commit/726b8f2e365fe8afeb3604a7c73d19b460395d58"},{"type":"PACKAGE","url":"https://github.com/mitmproxy/pdoc"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:38.043907417Z"}}