{"id":"CVE-2024-38526","aliases":["GHSA-5vgj-ggm4-fg62","PYSEC-2026-1764"],"title":"pdoc embeds link to malicious CDN if math mode is enabled","summary":"pdoc embeds link to malicious CDN if math mode is enabled","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L","vendor":"pdoc","product":"pdoc","ecosystem":"pip","affected":["pdoc < 14.5.1"],"patched":["pdoc 14.5.1"],"published":"2024-06-25","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-5vgj-ggm4-fg62","references":[{"url":"https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38526"},{"url":"https://github.com/mitmproxy/pdoc/pull/703"},{"url":"https://github.com/mitmproxy/pdoc/commit/726b8f2e365fe8afeb3604a7c73d19b460395d58"},{"url":"https://github.com/mitmproxy/pdoc"},{"url":"https://sansec.io/research/polyfill-supply-chain-attack"},{"url":"https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526"}],"tags":["osv","pip","exploit-available"],"epss":0.03832,"epssPercentile":0.89629,"ingestedAt":"2026-07-08T18:25:46.219Z","exploits":{"github":2,"githubRepos":["https://github.com/putget/CVE-2024-38526","https://github.com/padayali-JD/pollyscan"],"checkedAt":"2026-09-23T07:13:29.764Z"},"exploitAvailable":true,"slug":"CVE-2024-38526","body":"## Overview\n\n### Impact\n\nDocumentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.\nThe polyfill.io CDN has been sold and now serves malicious code.\n\nUsers who produce documentation with math mode should update immediately. All other users are unaffected.\n\n### Patches\n\nThis issue has been fixed in pdoc 14.5.1.\n\n### References\n\nhttps://github.com/mitmproxy/pdoc/pull/703\nhttps://sansec.io/research/polyfill-supply-chain-attack\n\n### Timeline\n\n- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published.\n- **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz.\n- **[2024-06-25 21:33 UTC]** Patched version released.\n- **[2024-06-25 21:37 UTC]** Security advisory published.\n- **[2024-06-25 23:49 UTC]** CVE-2024-38526 assigned by GitHub.\n\n## Affected packages\n\n- `pdoc < 14.5.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `pdoc 14.5.1`","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":39.6,"likelihood":0.8,"exploitation":12,"ransomware":0},"changes":[{"seq":4722,"id":"CVE-2024-38526","ts":1788887202480,"field":"exploit_available","old":"false","new":"true"},{"seq":3605,"id":"CVE-2024-38526","ts":1788886318604,"field":"exploit_available","old":"true","new":"false"},{"seq":2459,"id":"CVE-2024-38526","ts":1788882987209,"field":"exploit_available","old":"false","new":"true"},{"seq":1488,"id":"CVE-2024-38526","ts":1788882400660,"field":"exploit_available","old":"true","new":"false"},{"seq":602,"id":"CVE-2024-38526","ts":1788881837156,"field":"exploit_available","old":"false","new":"true"}]}