CVE-2024-53386

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-53386
Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 Exploit Third Party Advisory
https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159 Product
https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:piqnt:stage.js:*:*:*:*:*:*:*:*
History

27 Jun 2025, 13:01

Type Values Removed Values Added
References () https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 - () https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 - Exploit, Third Party Advisory
References () https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159 - () https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159 - Product
CPE cpe:2.3:a:piqnt:stage.js:*:*:*:*:*:*:*:*
First Time Piqnt
Piqnt stage.js
CWE CWE-79

03 Mar 2025, 22:15

Type Values Removed Values Added
References () https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 - () https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 -
Summary
  • (es) Stage.js hasta 0.8.10 permite el DOM Clobbering (con el consiguiente XSS para entradas no confiables que contienen HTML pero no contienen directamente JavaScript), porque la búsqueda de document.currentScript puede ser ocultada por elementos HTML inyectados por el atacante.

03 Mar 2025, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-03 07:15

Updated : 2025-06-27 13:01

NVD link : CVE-2024-53386

Mitre link : CVE-2024-53386

CVE.ORG link : CVE-2024-53386

JSON object : View

Products Affected

piqnt

  • stage.js
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')