CVE-2024-53386

Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534	Exploit Third Party Advisory
https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159	Product
https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:piqnt:stage.js:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-03-03 07:15

Updated : 2025-06-27 13:01

NVD link : CVE-2024-53386

Mitre link : CVE-2024-53386

CVE.ORG link : CVE-2024-53386

JSON object : View

Products Affected

piqnt

stage.js

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-53386", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2025-03-03T07:15:34.560", "references": [{"url": "https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements."}, {"lang": "es", "value": "Stage.js hasta 0.8.10 permite el DOM Clobbering (con el consiguiente XSS para entradas no confiables que contienen HTML pero no contienen directamente JavaScript), porque la b\u00fasqueda de document.currentScript puede ser ocultada por elementos HTML inyectados por el atacante."}], "lastModified": "2025-06-27T13:01:00.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:piqnt:stage.js:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B52A6B1D-156D-407C-A114-1B2097EB442F", "versionEndIncluding": "0.8.10"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}