https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:47:36 +0000 https://cve.radiocsirt.org/vuln/cve-2024-38526 <p><strong>Affected:</strong> mitmproxy pdoc</p> <p>pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.</p> <p><strong>Affected:</strong> mitmproxy pdoc</p> <p>pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.</p> https://cve.radiocsirt.org/vuln/cve-2024-38526 https://cve.radiocsirt.org/vuln/ghsa-5vgj-ggm4-fg62 <p><strong>Affected:</strong> PyPI: pdoc</p> <p>### Impact</p> <p>Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code.</p> <p>Users who produce documentation with math mode should update immediately. All other users are unaffected.</p> <p>### Patches</p> <p>This issue has been fixed in pdoc 14.5.1.</p> <p>### References</p> <p>https://github.com/mitmproxy/pdoc/pull/703 https://sansec.io/research/polyfill-supply-chain-attack</p> <p>### Timeline</p> <p>- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published. - **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz. - **[2024-06-25 21:33 UTC]** Patched version released. - **[2024-06-25 21:37 UTC]** Security advisory published. - **[2024-06-25 23:49 UTC]** CVE-2024-38526 assigned by GitHub.</p> <p><strong>Affected:</strong> PyPI: pdoc</p> <p>### Impact</p> <p>Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code.</p> <p>Users who produce documentation with math mode should update immediately. All other users are unaffected.</p> <p>### Patches</p> <p>This issue has been fixed in pdoc 14.5.1.</p> <p>### References</p> <p>https://github.com/mitmproxy/pdoc/pull/703 https://sansec.io/research/polyfill-supply-chain-attack</p> <p>### Timeline</p> <p>- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published. - **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz. - **[2024-06-25 21:33 UTC]** Patched version released. - **[2024-06-25 21:37 UTC]** Security advisory published. - **[2024-06-25 23:49 UTC]** CVE-2024-38526 assigned by GitHub.</p> https://cve.radiocsirt.org/vuln/ghsa-5vgj-ggm4-fg62