\n- delete author\n- view audit of authors\n- alert is displayed\n\n### Impact\npersistent XSS. JS can be injected and executed.\n"}},{"@type":"Question","name":"How severe is CVE-2024-45592?","acceptedAnswer":{"@type":"Answer","text":"CVE-2024-45592 has a CVSS score of 8.2/10, rated HIGH. Immediate patching is strongly recommended."}},{"@type":"Question","name":"Which packages are affected by CVE-2024-45592?","acceptedAnswer":{"@type":"Answer","text":"CVE-2024-45592 affects the following packages: damienharper/auditor-bundle (Packagist). Ecosystems affected: Packagist."}},{"@type":"Question","name":"How do I fix CVE-2024-45592?","acceptedAnswer":{"@type":"Answer","text":"Update damienharper/auditor-bundle to 5.2.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-45592 is resolved across your whole dependency graph."}},{"@type":"Question","name":"How do I detect CVE-2024-45592 in my Packagist dependencies?","acceptedAnswer":{"@type":"Answer","text":"Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for damienharper/auditor-bundle, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version."}},{"@type":"Question","name":"How do I mitigate CVE-2024-45592 if there is no patch (or I can't update yet)?","acceptedAnswer":{"@type":"Answer","text":"Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page."}},{"@type":"Question","name":"Is CVE-2024-45592 actively exploited in the wild?","acceptedAnswer":{"@type":"Answer","text":"No public exploit code has been indexed for CVE-2024-45592 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure."}},{"@type":"Question","name":"What is the EPSS score for CVE-2024-45592?","acceptedAnswer":{"@type":"Answer","text":"CVE-2024-45592 has an EPSS (Exploit Prediction Scoring System) score of 0.4%, placing it in the 39th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority."}},{"@type":"Question","name":"What type of vulnerability is CVE-2024-45592?","acceptedAnswer":{"@type":"Answer","text":"CVE-2024-45592 is classified as Cross-site Scripting (XSS) (CWE-79). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation. This is a high-impact weakness class that often enables remote code execution or data exposure."}},{"@type":"Question","name":"When was CVE-2024-45592 published, and has it been updated?","acceptedAnswer":{"@type":"Answer","text":"CVE-2024-45592 was published on September 10, 2024 and was last updated on October 28, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting."}}]}
NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
HIGH severity

CVE-2024-45592 — auditor-bundle

HIGHFix: DamienHarper/auditor-bundle@42ba294

CVE-2024-45592 is a high-severity (CVSS 8.2) Cross-site Scripting (XSS) vulnerability in damienharper/auditor-bundle. A fix is available for damienharper/auditor-bundle — see the affected versions and patch details below.

auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped

Also known asGHSA-78vg-7v27-hj67
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 1, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-45592.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs39th percentile — riskier than 39% of all scored CVEsHighest risk
0.00%0.32%0.63%0.95%0.4%0.4%May 26Aug 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐘damienharper/auditor-bundle

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

Unescaped entity property enables Javascript injection.

Details

I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.

PoC

Impact

persistent XSS. JS can be injected and executed.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistdamienharper/auditor-bundleall versions5.2.6composer require damienharper/auditor-bundle:^5.2.6

Affected Products

1 product · 1 configurations
Application
auditor-bundledamienharper
≥ 5.0.0 && < 5.2.6
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for damienharper/auditor-bundle, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update damienharper/auditor-bundle to 5.2.6 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-45592 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Summary Unescaped entity property enables Javascript injection. ### Details I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed. ### PoC - clone example project https://github.com/DamienHarper/auditor-bundle-demo - create author with FullName <script>alert()</script> - delete author - view audit of authors - alert is displayed ### Impact persistent XSS. JS can be injected and executed.
O3 Security · Impact-Aware SCA

Is CVE-2024-45592 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2024-45592: auditor-bundle XSS — Fixed in 5.2.6