PT-2024-31592 · Pagefind · Pagefind

Alexander-Akait · Published 2024-08-27 · Updated 2025-10-14 · CVE-2024-45389

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions: Pagefind versions prior to 1.1.1

Description: A DOM Clobbering vulnerability exists in Pagefind, allowing an attacker to inject malicious HTML and escalate privileges. This occurs when an attacker can add elements to a page, such as img tags with a name attribute, but not others, as adding a script would be an XSS vector. The vulnerability relies on the document.currentScript.src lookup being shadowed by an attacker-controlled HTML element, causing Pagefind to load dependencies from an external domain. There are no reports of this being exploited in the wild via Pagefind.

Recommendations: For Pagefind versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue. As a temporary workaround, consider restricting the ability to inject HTML elements with name attributes on pages using Pagefind.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-45389

GHSA-4VVJ-4CPR-P986

GHSA-64VR-G452-QVP3

GHSA-GPRJ-6M2F-J9HX

Affected Products

Pagefind

References · 32

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45389.json · Exploit
• https://github.com/CloudCannon/pagefind/commit/14ec96864eabaf1d7d809d5da0186a8856261eeb · Patch
• https://github.com/CloudCannon/pagefind/security/advisories/GHSA-gprj-6m2f-j9hx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45389 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-45812 · Security Note
• https://osv.dev/vulnerability/GHSA-4vvj-4cpr-p986 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-45389 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-43788 · Security Note
• https://osv.dev/vulnerability/GHSA-64vr-g452-qvp3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gprj-6m2f-j9hx · Vendor Advisory
• https://github.com/vitejs/vite · Note
• https://github.com/vitejs/vite/commit/2ddd8541ec3b2d2e5b698749e0f2362ef28056bd · Note
• https://github.com/vitejs/vite/commit/ebb94c5b3bf41950f45562595adec117a4d0ba5e · Note
• https://github.com/vitejs/vite/commit/2691bb3ff6b073b41fb9046909e1e03a74e36675 · Note
• https://github.com/vitejs/vite/commit/179b17773cf35c73ddb041f9e6c703fd9f3126af · Note