UBUNTU-CVE-2024-53382

Prism aka PrismJS through 1.29.0 allows DOM Clobbering with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript, because document.currentScript lookup can be shadowed by attacker-injected HTML elements...

tsup 跨站脚本漏洞

tsup is one of the easiest and fastest ways to bundle TypeScript libraries for EGOIST individual developers. A security vulnerability exists in tsup version v8.3.4, which stems from DOM Clobbering from import.meta.url to document.currentScript, allowing execution of arbitrary code...

Mavo 跨站脚本漏洞

Mavo is a framework from the Mavo open source. A security vulnerability exists in Mavo version v0.3.2, which stems from DOM Clobbering and allows execution of arbitrary code via specially crafted HTML elements...

PT-2025-9272 · Stage.Js · Stage.Js

Name of the Vulnerable Software and Affected Versions: Stage.js versions 0.8.10 and earlier Description: The issue allows DOM Clobbering, which can result in XSS for untrusted input that contains HTML but does not directly contain JavaScript. This is because the document.currentScript lookup can ...

PT-2025-9273

Name of the Vulnerable Software and Affected Versions Prism aka PrismJS versions prior to 1.29.0 Description The issue allows DOM Clobbering, which can result in XSS for untrusted input that contains HTML but does not directly contain JavaScript. This occurs because the document.currentScript...

CVE-2024-53388

A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element...

CVE-2024-53382

PrismJS (Prism) 1.29.0 and earlier is vulnerable to DOM clobbering that can lead to XSS when untrusted HTML containing markup is processed, because document.currentScript can be shadowed by attacker-injected HTML elements. IBM security notes tie CVE-2024-53382 to PrismJS and document the affected...

CVE-2024-53386

CVE-2024-53386 affects Stage.js up to version 0.8.10. The vulnerability arises from a DOM clobbering flaw where the lookup for document.currentScript can be shadowed by attacker-injected HTML elements, enabling XSS on untrusted input that contains HTML but does not itself include JavaScript. The ...

CVE-2024-53384

The tsup (NPM) package version v8.3.4 is vulnerable to a DOM Clobbering vulnerability. The root cause is a lack of measures to protect the website structure, which allows an attacker to execute arbitrary code by utilizing a crafted script targeting import.meta.url to document.currentScript within...

CVE-2024-53387

A DOM Clobbering vulnerability exists in umeditor v1.2.3 , a rich text editor developed by the Baidu FEX team. This flaw allows an attacker to execute arbitrary code by supplying a crafted HTML element to the application. The vulnerability is categorized as Improper Neutralization of Input During...

CVE-2024-53386

Stage.js through 0.8.10 allows DOM Clobbering with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript, because document.currentScript lookup can be shadowed by attacker-injected HTML elements...

CVE-2024-53382

Prism aka PrismJS through 1.29.0 allows DOM Clobbering with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript, because document.currentScript lookup can be shadowed by attacker-injected HTML elements...

CVE-2024-53387

A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element...

CVE-2024-53384

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

CVE-2024-53382

Prism aka PrismJS through 1.29.0 allows DOM Clobbering with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript, because document.currentScript lookup can be shadowed by attacker-injected HTML elements...

CVE-2024-53388

A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element...

CVE-2024-53387

A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element...

CVE-2024-53384

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

CVE-2024-53388

A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element...

CVE-2024-53386

Stage.js through 0.8.10 allows DOM Clobbering with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript, because document.currentScript lookup can be shadowed by attacker-injected HTML elements...