GitHub Advisoryadvisory · npm

GHSA-fp3m-g5rc-4c28 Stage.js DOM Clobbering vulnerabilty

MEDIUM Published 2025-03-03 Modified 2025-06-30 Official page ↗
Aliases
CVE-2024-53386
Ecosystem
npm
Packages
stage-js
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-79, CWE-94
Reviewed
2025-03-03

Affected packages

• npm stage-js: <= 0.8.10 (no fix yet)

Description

Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Related

Alias · CVE (1)

  • CVE-2024-53386 Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain… vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References