The vulnerability of the Tsup collector lies in the lack of measures taken to protect the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Tsup collector is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created script in import.meta.url...

EUVD-2025-5525

Malicious code in bioql PyPI...

Cross-site Scripting

Tsup is vulnerable to DOM Clobbering. The vulnerability is due to DOM Clobbering caused by a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

CVE-2024-53384

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

@assistant-ui/react-ai-sdk (>=0.5.2, <=0.5.4), @avmkit/pipeline (1.0.3) +86 more potentially affected by CVE-2024-53384 via tsup (>=8.0.0, <=8.3.0)

tsup NPM version =8.0.0, =0.5.2, =1.0.1, =1.0.0, =0.0.2, =0.1.5, =1.0.0, =0.0.15, =0.0.0, =1.0.10, =1.4.2, =2.0.0, =2.0.2 and more Source cves: CVE-2024-53384 Source advisory: OSV:GHSA-3MV9-4H5G-VHG3...

tsup DOM Clobbering vulnerability

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

GHSA-3MV9-4H5G-VHG3 tsup DOM Clobbering vulnerability

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

CVE-2024-53384

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

CVE-2024-53384: Improper Neutralization of Input During Web Page Generation

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

CVE-2024-53384

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

CVE-2024-53384

The tsup (NPM) package version v8.3.4 is vulnerable to a DOM Clobbering vulnerability. The root cause is a lack of measures to protect the website structure, which allows an attacker to execute arbitrary code by utilizing a crafted script targeting import.meta.url to document.currentScript within...

CVE-2024-53384

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

tsup 跨站脚本漏洞

tsup is one of the easiest and fastest ways to bundle TypeScript libraries for EGOIST individual developers. A security vulnerability exists in tsup version v8.3.4, which stems from DOM Clobbering from import.meta.url to document.currentScript, allowing execution of arbitrary code...

PT-2025-9528

Name of the Vulnerable Software and Affected Versions tsup version 8.3.4 Description A DOM Clobbering issue allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs shims.js components. Recommendations For tsup version 8.3.4, at the...

CVE-2024-53384

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...

CVE-2024-53384

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjsshims.js components...