17 matches found
Tsup collector Code Execution
The vulnerability of the Tsup collector is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created script in import.meta.url...
EUVD-2025-5525
Malicious code in bioql PyPI...
Cross-site Scripting
Tsup is vulnerable to DOM Clobbering. The vulnerability is due to DOM Clobbering caused by a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...
CVE-2024-53384
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...
GHSA-3MV9-4H5G-VHG3 tsup DOM Clobbering vulnerability
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...
@assistant-ui/react-ai-sdk (>=0.5.2, <=0.5.4), @avmkit/pipeline (1.0.3) +96 more potentially affected by CVE-2024-53384 via tsup (>=8.0.0, <=8.3.0)
tsup NPM version =8.0.0, =0.5.2, =1.0.1, =1.0.0, =3.0.0-canary.0.0c9beb2ae, =4.0.0-canary.0.0c9beb2ae, =0.1.0-canary.0.0c9beb2ae, =0.0.2, =0.1.5, =0.1.0-canary.0.0c9beb2ae, =1.0.0, =0.0.15, =0.0.1-canary.0.0c9beb2ae, =0.0.1 and more Source cves: CVE-2024-53384 Source advisory:...
tsup DOM Clobbering vulnerability
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...
@assistant-ui/react-ai-sdk (>=0.5.2, <=0.5.4), @avmkit/pipeline (1.0.3) +96 more potentially affected by CVE-2024-53384 via tsup (>=8.0.0, <=8.3.0)
tsup NPM version =8.0.0, =0.5.2, =1.0.1, =1.0.0, =3.0.0-canary.0.0c9beb2ae, =4.0.0-canary.0.0c9beb2ae, =0.1.0-canary.0.0c9beb2ae, =0.0.2, =0.1.5, =0.1.0-canary.0.0c9beb2ae, =1.0.0, =0.0.15, =0.0.1-canary.0.0c9beb2ae, =0.0.1 and more Source cves: CVE-2024-53384 Source advisory: GHSA-3MV9-4H5G-VHG3...
CVE-2024-53384
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...
CVE-2024-53384
The tsup (NPM) package version v8.3.4 is vulnerable to a DOM Clobbering vulnerability. The root cause is a lack of measures to protect the website structure, which allows an attacker to execute arbitrary code by utilizing a crafted script targeting import.meta.url to document.currentScript within...
CVE-2024-53384
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...
CVE-2024-53384: Improper Neutralization of Input During Web Page Generation
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...
PT-2025-9528
Name of the Vulnerable Software and Affected Versions tsup version 8.3.4 Description A DOM Clobbering issue allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs shims.js components. Recommendations For tsup version 8.3.4, at the...
tsup Cross-Site Scripting Vulnerabilities
tsup is one of the easiest and fastest ways to bundle TypeScript libraries for EGOIST individual developers. A security vulnerability exists in tsup version v8.3.4, which stems from DOM Clobbering from import.meta.url to document.currentScript, allowing execution of arbitrary code...
CVE-2024-53384
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...
