CVE-2024-38526

pdoc provides API Documentation for Python Projects. Documentation generated with "pdoc --math" linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...

CVE-2024-38526

The pdoc Python library for API documentation is affected by a supply chain attack where documentation generated with pdoc --math linked to malicious JavaScript files from the compromised polyfill.io CDN. This issue is fixed in pdoc version 14.5.1 . Several security tools, including pollyscan and...

CVE-2024-38526 pdoc embeds link to malicious CDN if math mode is enabled

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...

CVE-2024-38526 pdoc embeds link to malicious CDN if math mode is enabled

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...

CVE-2024-38526 pdoc embeds link to malicious CDN if math mode is enabled

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1...

autohooks-plugin-pdoc (>=0.1.1, <=0.1.2), bond-order-processing (1.0.3) +22 more potentially affected by CVE-2024-38526 via pdoc (>=0.3.2, <=14.5.0)

pdoc PYPI version =0.3.2, =0.1.1, =1.0.0, =0.9.4, =0.0.7, =2.5.7, =0.2.3, =0.1.1, =0.4.5, =0.2.0, =0.3.0, =0.6.0 and more Source cves: CVE-2024-38526 Source advisory: MEND:CVE-2024-38526...

pdoc embeds link to malicious CDN if math mode is enabled

Impact Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. Users who produce documentation with math mode should update immediately. All other users are unaffected. Patches This issue has been fixed...

GHSA-5VGJ-GGM4-FG62 pdoc embeds link to malicious CDN if math mode is enabled

Impact Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. Users who produce documentation with math mode should update immediately. All other users are unaffected. Patches This issue has been fixed...

autohooks-plugin-pdoc (>=0.1.1, <=0.1.2), django-pdf-reactor (0.1.3) potentially affected by CVE-2024-38526 via pdoc (0.3.2)

pdoc PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - autohooks-plugin-pdoc =0.1.1, =0.1.2 - django-pdf-reactor 0.1.3 Source cves: CVE-2024-38526 Source advisory: OSV:GHSA-5VGJ-GGM4-FG62...

pyriksprot (>=2021.9.7, <=2021.12.10) potentially affected by CVE-2024-38526 via pdoc (8.3.0)

pdoc PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - pyriksprot =2021.9.7, =2021.12.10 Source cves: CVE-2024-38526 Source advisory: OSV:GHSA-5VGJ-GGM4-FG62...

elemeno-mlops-client (>=0.0.7, <=0.0.20) potentially affected by CVE-2024-38526 via pdoc (11.0.0)

pdoc PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - elemeno-mlops-client =0.0.7, =0.0.20 Source cves: CVE-2024-38526 Source advisory: OSV:GHSA-5VGJ-GGM4-FG62...

spam-analyzer (>=0.0.1, <=0.1.2) potentially affected by CVE-2024-38526 via pdoc (12.3.0)

pdoc PYPI version 12.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - spam-analyzer =0.0.1, =0.1.2 Source cves: CVE-2024-38526 Source advisory: OSV:GHSA-5VGJ-GGM4-FG62...

pubmed-sdk (>=0.2.0, <=0.4.0) potentially affected by CVE-2024-38526 via pdoc (13.1.0)

pdoc PYPI version 13.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - pubmed-sdk =0.2.0, =0.4.0 Source cves: CVE-2024-38526 Source advisory: OSV:GHSA-5VGJ-GGM4-FG62...

devopsvalidatecpf (0.0.4), finite-state-sdk (0.1.6) +6 more potentially affected by CVE-2024-38526 via pdoc (>=14.0.0, <=14.5.0)

pdoc PYPI version =14.0.0, =2.5.7, =0.2.3, =0.1.1, =0.1.0, =0.0.2, =0.0.1, =0.0.2 Source cves: CVE-2024-38526 Source advisory: OSV:GHSA-5VGJ-GGM4-FG62...

devopsvalidatecpf (0.0.4), finite-state-sdk (0.1.6) +6 more potentially affected by CVE-2024-38526 via pdoc (>=14.0.0, <=14.5.0)

pdoc PYPI version =14.0.0, =2.5.7, =0.2.3, =0.1.1, =0.1.0, =0.0.2, =0.0.1, =0.0.2 Source cves: CVE-2024-38526 Source advisory: GHSA-5VGJ-GGM4-FG62...

simmate (>=0.8.0, <=0.9.0) potentially affected by CVE-2024-38526 via pdoc (12.0.2)

pdoc PYPI version 12.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - simmate =0.8.0, =0.9.0 Source cves: CVE-2024-38526 Source advisory: OSV:GHSA-5VGJ-GGM4-FG62...

bond-order-processing (1.0.3), mgnifyextract (0.0.2) +3 more potentially affected by CVE-2024-38526 via pdoc (12.3.1)

pdoc PYPI version 12.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - bond-order-processing 1.0.3 - mgnifyextract 0.0.2 - pyseafuel =0.1.1, =0.0.1, =1.1.1.dev0, =24.7.1 Source cves: CVE-2024-38526 Source advisory:...

camminapy (>=1.0.0, <=1.1.6), cb2game (>=0.9.4, <=1.0.3) +2 more potentially affected by CVE-2024-38526 via pdoc (13.1.1)

pdoc PYPI version 13.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pdoc and may be impacted: - camminapy =1.0.0, =0.9.4, =0.4.5, =0.3.0, =0.6.0 Source cves: CVE-2024-38526 Source advisory: OSV:GHSA-5VGJ-GGM4-FG62...