CVE-2024-38526 pdoc embeds link to malicious CDN if math mode is enabled
Attackers can execute malicious code in browsers viewing documentation generated with math mode enabled due to a compromised CDN link.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-38526?
CVE-2024-38526 is a vulnerability in mitmproxy pdoc, published on 25 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.
Weakness: CWE-1395
Which versions are affected by CVE-2024-38526?
3 open source packages ship an affected version, including pdoc.
| Package | Affected | Fixed in |
|---|---|---|
pdoc PyPI | All versions | 14.5.1 |
pdoc PyPI | All versions | 14.5.1 |
pdoc PyPI | All versions | 14.5.1 |
Linux distribution packages (4)
ghc-pandoc SUSE:Linux Enterprise Module for Package Hub 15 SP6 | All versions | 3.1.11.1-150500.11.6.1 |
ghc-pandoc SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 3.1.11.1-150500.11.6.1 |
ghc-pandoc openSUSE:Leap 15.6 | All versions | 3.1.11.1-150500.11.6.1 |
netpbm openSUSE:Tumbleweed | All versions | 11.7.0-1.1 |
How do I fix CVE-2024-38526?
Upgrade pdoc to 14.5.1 or later.
Is CVE-2024-38526 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-38526 exists.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-5vgj-ggm4-fg62, PYSEC-2026-1764, SUSE-SU-2025:02037-1, openSUSE-SU-2024:14187-1.