{"answers":{"affected":"","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52286 exists.","fix":"No fix has been published for CVE-2024-52286 yet. Limit exposure of the affected software until one is available.","what":"CVE-2024-52286 is a low-severity cross-site scripting vulnerability in Stirling-Tools Stirling-PDF, published on 11 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-52286 and fix it if it is affected.\n\nWhat it is: CVE-2024-52286 is a low-severity cross-site scripting vulnerability in Stirling-Tools Stirling-PDF, published on 11 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52286 exists.\n\nAffected product: Stirling-Tools Stirling-PDF. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-52286/ (Markdown: https://insights.sbomify.com/CVE-2024-52286/index.md)","id":"CVE-2024-52286","markdown":"https://insights.sbomify.com/CVE-2024-52286/index.md","name":"CVE-2024-52286","record":{"aliases":["GHSA-9j55-gvf2-cqwv"],"analysis":{"component_type":"web_application","fix_type":"upgrade","impacts":["code_execution","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"PDF processing web app","requires_auth":"low_privilege","summary":"Attackers can execute JavaScript via malicious filenames in Stirling-PDF's merge feature, potentially enabling phishing or session hijacking.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":2,"severity":"low","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"},{"id":"CWE-20","name":"Improper Input Validation"}],"description":"Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes untrusted user input (file name) and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code in the context of the user. The issue stems to the code starting at `Line 24` in `src/main/resources/static/js/merge.js`. The file name is directly being input into InnerHTML with no sanitization on the file name, allowing a malicious user to be able to upload files with names containing HTML tags. As HTML tags can include JavaScript code, this can be used to execute JavaScript code in the context of the user. This is a self-injection style attack and relies on a user uploading the malicious file themselves and it impact only them, not other users. A user might be social engineered into running this to launch a phishing attack. Nevertheless, this breaks the expected security restrictions in place by the application. This issue has been addressed in version 0.32.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":false,"headline":"Self Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDF","id":"CVE-2024-52286","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"xss","year":"2024"},"n_packages":0,"n_references":2,"next":{"headline":"authentik performs insufficient validation of OAuth scopes","id":"CVE-2024-52287"},"packages":[],"prev":{"headline":"Missing authorization in SiPass integrated AC5102 (ACC-G2)","id":"CVE-2024-52285"},"products":["Stirling-PDF"],"published":"2024-11-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-01-09","vendors":["Stirling-Tools"]},"summary":"Attackers can execute JavaScript via malicious filenames in Stirling-PDF's merge feature, potentially enabling phishing or session hijacking.","url":"https://insights.sbomify.com/CVE-2024-52286/"}