PT-2021-24349 · Unknown · Molecularfaces

Published 2021-04-16 · Updated 2025-11-28 · CVE-2024-0758

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: MolecularFaces versions prior to 0.3.0

Description: The issue allows a remote attacker to execute arbitrary JavaScript in the context of a victim browser via crafted molfiles. This is due to the viewer plugin implementation of <mol:molecule> rendering molfile data directly inside a <script> tag without any escaping, allowing arbitrary JavaScript code to be executed in the client browser.

Recommendations: For versions prior to 0.3.0, update to version 0.3.0 or later, where molfile data is now rendered as the value of a hidden <input> tag and escaped via JSF's mechanisms. As a temporary workaround, consider restricting the use of crafted molfiles until a patch is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-0758

GHSA-2PWH-52H7-7J84

GHSA-WC6F-QJXC-622V

Affected Products

Molecularfaces

References · 11

• https://github.com/ipb-halle/MolecularFaces/security/advisories/GHSA-2pwh-52h7-7j84 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0758 · Security Note
• https://osv.dev/vulnerability/GHSA-2pwh-52h7-7j84 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wc6f-qjxc-622v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-0758 · Vendor Advisory
• https://github.com/ipb-halle/MolecularFaces · Note
• https://twitter.com/VulmonFeeds/status/1748491258601799966 · Twitter Post
• https://t.me/cveNotify/144294 · Telegram Post
• https://vulncheck.com/advisories/vc-advisory-GHSA-2pwh-52h7-7j84 · Note
• https://github.com/advisories/GHSA-2pwh-52h7-7j84 · Note
• https://twitter.com/CVEnew/status/1748442358101008489 · Twitter Post