What’s Vulnerable › Vulnerabilities

CVE-2024-53386

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-03 · updated 2026-06-17
• Weakness: CWE-94

Description

Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Affected products

• Piqnt Stage.js: through 0.8.10

References

• https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534
• https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159
• https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534

Get alerted when CVE-2024-53386 or the next vulnerability affects your stack