PT-2025-9528 · Tsup · Tsup

Jackfromeast · Published 2025-03-03 · Updated 2025-03-07 · CVE-2024-53384

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions tsup version 8.3.4

Description A DOM Clobbering issue allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs shims.js components.

Recommendations For tsup version 8.3.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-00154

CVE-2024-53384

GHSA-3MV9-4H5G-VHG3

Affected Products

Tsup

References · 10

• https://gist.github.com/jackfromeast/36f98bf7542d11835c883c1d175d9b92 · Patch
• https://bdu.fstec.ru/vul/2026-00154 · Security Note
• https://osv.dev/vulnerability/GHSA-3mv9-4h5g-vhg3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53384 · Security Note
• https://osv.dev/vulnerability/CVE-2024-53384 · Vendor Advisory
• https://github.com/egoist/tsup · Note
• https://twitter.com/CVEnew/status/1897912345814614479 · Twitter Post
• https://github.com/advisories/GHSA-3mv9-4h5g-vhg3 · Note
• https://feedly.com/cve/CVE-2024-53384 · Note
• https://t.me/cvedetector/19408 · Telegram Post