PT-2025-9528 · Tsup · Tsup

Jackfromeast · Publicado 2025-03-03 · Atualizado 2025-03-07 · CVE-2024-53384

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions tsup version 8.3.4

Description A DOM Clobbering issue allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs shims.js components.

Recommendations For tsup version 8.3.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2026-00154

CVE-2024-53384

GHSA-3MV9-4H5G-VHG3

Produtos afetados

Tsup

Referências · 10

• https://github.com/egoist/tsup · Nota
• https://twitter.com/CVEnew/status/1897912345814614479 · Publicação no Twitter
• https://gist.github.com/jackfromeast/36f98bf7542d11835c883c1d175d9b92 · Correção
• https://bdu.fstec.ru/vul/2026-00154 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-3mv9-4h5g-vhg3 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2024-53384 · Nota de Segurança
• https://github.com/advisories/GHSA-3mv9-4h5g-vhg3 · Nota
• https://osv.dev/vulnerability/CVE-2024-53384 · Aviso do Fabricante
• https://feedly.com/cve/CVE-2024-53384 · Nota
• https://t.me/cvedetector/19408 · Publicação no Telegram