---
id: CVE-2024-38526
aliases:
  - GHSA-5vgj-ggm4-fg62
  - PYSEC-2026-1764
title: pdoc embeds link to malicious CDN if math mode is enabled
summary: pdoc embeds link to malicious CDN if math mode is enabled
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L'
vendor: pdoc
product: pdoc
ecosystem: pip
affected:
  - pdoc < 14.5.1
patched:
  - pdoc 14.5.1
published: '2024-06-25'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-5vgj-ggm4-fg62'
references:
  - url: 'https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-38526'
  - url: 'https://github.com/mitmproxy/pdoc/pull/703'
  - url: >-
      https://github.com/mitmproxy/pdoc/commit/726b8f2e365fe8afeb3604a7c73d19b460395d58
  - url: 'https://github.com/mitmproxy/pdoc'
  - url: 'https://sansec.io/research/polyfill-supply-chain-attack'
  - url: 'https://www.vicarius.io/vsociety/posts/polyfillio-in-pdoc-cve-2024-38526'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.03832
epssPercentile: 0.8969
ingestedAt: '2026-07-08T18:25:46.219Z'
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/putget/CVE-2024-38526'
    - 'https://github.com/padayali-JD/pollyscan'
  checkedAt: '2026-09-25T08:20:43.291Z'
exploitAvailable: true
---

## Overview

### Impact

Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.
The polyfill.io CDN has been sold and now serves malicious code.

Users who produce documentation with math mode should update immediately. All other users are unaffected.

### Patches

This issue has been fixed in pdoc 14.5.1.

### References

https://github.com/mitmproxy/pdoc/pull/703
https://sansec.io/research/polyfill-supply-chain-attack

### Timeline

- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published.
- **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz.
- **[2024-06-25 21:33 UTC]** Patched version released.
- **[2024-06-25 21:37 UTC]** Security advisory published.
- **[2024-06-25 23:49 UTC]** CVE-2024-38526 assigned by GitHub.

## Affected packages

- `pdoc < 14.5.1`

## Remediation

Upgrade to a patched release:

- `pdoc 14.5.1`