VYPR
← All advisories
High severity7.2OSV Advisory· Published Jun 26, 2024· Updated Apr 15, 2026

CVE-2024-38526

CVE-2024-38526

Description

pdoc provides API Documentation for Python Projects. Documentation generated with pdoc --math linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
pdocPyPI
< 14.5.114.5.1

Affected products

1

Patches

2
9af869689fef
https://github.com/mitmproxy/pdocvia osv
commit
726b8f2e365f

remove references to polyfill.io (#703)

https://github.com/mitmproxy/pdocDrew HintzJun 25, 2024via ghsa
commit
3 files changed · +0 −3
  • pdoc/templates/math.html.jinja2+0 −1 modified
    @@ -10,7 +10,6 @@
         }
     };
 </script>
-<script src="https://polyfill.io/v3/polyfill.min.js?features=es6"></script>
 <script id="MathJax-script" async src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js"></script>
 <script>
     /* Re-invoke MathJax when DOM content changes, for example during search. */
  • test/testdata/math_demo.html+0 −1 modified
    @@ -18,7 +18,6 @@
         }
     };
 </script>
-<script src="https://polyfill.io/v3/polyfill.min.js?features=es6"></script>
 <script id="MathJax-script" async src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js"></script>
 <script>
     /* Re-invoke MathJax when DOM content changes, for example during search. */
  • test/testdata/math_misc.html+0 −1 modified
    @@ -18,7 +18,6 @@
         }
     };
 </script>
-<script src="https://polyfill.io/v3/polyfill.min.js?features=es6"></script>
 <script id="MathJax-script" async src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js"></script>
 <script>
     /* Re-invoke MathJax when DOM content changes, for example during search. */

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.