CVE-2024-38526

CVE-2024-38526 - Polyfill Scanner: x Mass Urls Scanner The polyfill.io CDN, previously compromised to serve malicious code, has now been secured with the latest fix in pdoc 14.5.1. Overview Detect potential issues Automate repetitive tasks with ease Features High Confidence Alerts : Detects scrip...

pdoc embeds link to malicious CDN if math mode is enabled

ImpactDocumentation generated with pdoc --math linked to JavaScript files from polyfill.io.The polyfill.io CDN has been sold and now serves malicious code.Users who produce documentation with math mode should update immediately. All other users are unaffected. PatchesThis issue has been fixed in...

pubmed-sdk (>=0.2.0, <=0.4.0) potentially affected by CVE-2024-38526 via pdoc (13.1.0)

pdoc PYPI version 13.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - pubmed-sdk =0.2.0, =0.4.0 Source cves: CVE-2024-38526 Source advisory: OSV:PYSEC-2026-1764...

devopsvalidatecpf (0.0.4), finite-state-sdk (0.1.6) +6 more potentially affected by CVE-2024-38526 via pdoc (>=14.0.0, <=14.5.0)

pdoc PYPI version =14.0.0, =2.5.7, =0.2.3, =0.1.1, =0.1.0, =0.0.2, =0.0.1, =0.0.2 Source cves: CVE-2024-38526 Source advisory: OSV:PYSEC-2026-1764...

elemeno-mlops-client (>=0.0.7, <=0.0.20) potentially affected by CVE-2024-38526 via pdoc (11.0.0)

pdoc PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - elemeno-mlops-client =0.0.7, =0.0.20 Source cves: CVE-2024-38526 Source advisory: OSV:PYSEC-2026-1764...

simmate (>=0.8.0, <=0.9.0) potentially affected by CVE-2024-38526 via pdoc (12.0.2)

pdoc PYPI version 12.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - simmate =0.8.0, =0.9.0 Source cves: CVE-2024-38526 Source advisory: OSV:PYSEC-2026-1764...

bond-order-processing (1.0.3), mgnifyextract (0.0.2) +3 more potentially affected by CVE-2024-38526 via pdoc (12.3.1)

pdoc PYPI version 12.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - bond-order-processing 1.0.3 - mgnifyextract 0.0.2 - pyseafuel =0.1.1, =0.0.1, =1.1.1.dev0, =24.7.1 Source cves: CVE-2024-38526 Source advisory:...

autohooks-plugin-pdoc (>=0.1.1, <=0.1.2), django-pdf-reactor (0.1.3) potentially affected by CVE-2024-38526 via pdoc (0.3.2)

pdoc PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - autohooks-plugin-pdoc =0.1.1, =0.1.2 - django-pdf-reactor 0.1.3 Source cves: CVE-2024-38526 Source advisory: OSV:PYSEC-2026-1764...

PYSEC-2026-1764 pdoc embeds link to malicious CDN if math mode is enabled

Impact Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. Users who produce documentation with math mode should update immediately. All other users are unaffected. Patches This issue has been fixed...

spam-analyzer (>=0.0.1, <=0.1.2) potentially affected by CVE-2024-38526 via pdoc (12.3.0)

pdoc PYPI version 12.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - spam-analyzer =0.0.1, =0.1.2 Source cves: CVE-2024-38526 Source advisory: OSV:PYSEC-2026-1764...

camminapy (>=1.0.0, <=1.1.6), cb2game (>=0.9.4, <=1.0.3) +2 more potentially affected by CVE-2024-38526 via pdoc (13.1.1)

pdoc PYPI version 13.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - camminapy =1.0.0, =0.9.4, =0.4.5, =0.3.0, =0.6.0 Source cves: CVE-2024-38526 Source advisory: OSV:PYSEC-2026-1764...

pyriksprot (>=2021.9.7, <=2021.12.10) potentially affected by CVE-2024-38526 via pdoc (8.3.0)

pdoc PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - pyriksprot =2021.9.7, =2021.12.10 Source cves: CVE-2024-38526 Source advisory: OSV:PYSEC-2026-1764...

Pdoc Python Library <= 14.5.1 (CVE-2024-38526)

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1. Note that Nessus has not tested for this issue but...

K000141256: Polyfill vulnerability CVE-2024-38526

Security Advisory Description pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill. io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1. CVE-2024-38526 Impac...

SUSE CVE-2024-38526

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...

VulnCheck KEV: CVE-2024-38526

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...

Malicious CDN Embedding

pdoc is vulnerable to malicious CDN embedding. The vulnerability is caused when documentation is generated with math mode pdoc --math due to the usage of a compromised polyfill.io CDN domain. An attacker could potentially exploit this by injecting malicious code into documentation generated with...

CVE-2024-38526

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...

CVE-2024-38526: Dependency on Vulnerable Third-Party Component

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...

pdoc Security Vulnerabilities

pdoc is an API documentation for Python projects open-sourced by mitmproxy. A security vulnerability exists in pdoc prior to version 14.5.1, which stems from the pdoc --math command generating a link to a document that points to a CDN that is no longer secure...