PT-2025-9272 · Stage.Js · Stage.Js

Jackfromeast · Published 2025-03-03 · Updated 2025-06-27 · CVE-2024-53386

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Stage.js versions 0.8.10 and earlier

Description The issue allows DOM Clobbering, which can result in XSS for untrusted input that contains HTML but does not directly contain JavaScript. This is because the document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Recommendations For Stage.js versions 0.8.10 and earlier, as a temporary workaround, consider restricting the use of document.currentScript until a patch is available.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2024-53386

GHSA-FP3M-G5RC-4C28

Affected Products

Stage.Js

References · 11

• 🔥 https://gist.github.com/jackfromeast/31d56f1ad17673aabb6ab541e65a5534 · Exploit
• https://osv.dev/vulnerability/CVE-2024-53386 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53386 · Security Note
• https://osv.dev/vulnerability/GHSA-fp3m-g5rc-4c28 · Vendor Advisory
• https://github.com/piqnt/stage.js · Note
• https://github.com/piqnt/stage.js/blob/919f6e94b14242f6e6994141a9e1188439d306d5/lib/core.js#L158-L159 · Note
• https://t.me/cvenotify/126874 · Telegram Post
• https://t.me/cvedetector/19310 · Telegram Post
• https://t.me/cvenotify/113263 · Telegram Post
• https://twitter.com/CVEnew/status/1897912346728972593 · Twitter Post
• https://t.me/cvenotify/113064 · Telegram Post