CVE-2024-45389

Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script the user loads. This information is gathered by looking up the value of `document.currentScript.src`. Prior to Pagefind version 1.1.1, it is possible to "clobber" this lookup with otherwise benign HTML on the page. This will cause `document.currentScript.src` to resolve as an external domain, which will then be used by Pagefind to load dependencies. This exploit would only work in the case that an attacker could inject HTML to a live, hosted, website. In these cases, this would act as a way to escalate the privilege available to an attacker. This assumes they have the ability to add some elements to the page (for example, `img` tags with a `name` attribute), but not others, as adding a `script` to the page would itself be the cross-site scripting vector. Pagefind has tightened this resolution in version 1.1.1 by ensuring the source is loaded from a valid script element. There are no reports of this being exploited in the wild via Pagefind.

• CWE-79
• CWE-79

• https://github.com/CloudCannon/pagefind/commit/14ec96864eabaf1d7d809d5da0186a8856261eebPatch
• https://github.com/CloudCannon/pagefind/security/advisories/GHSA-gprj-6m2f-j9hxVendor Advisory
• https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986Not Applicable

Published

Sep 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45383A mishandling of IRP requests vulnerability exists in the HD…5
• CVE-2024-45384Padding Oracle vulnerability in Apache Druid extension, drui…5.3
• CVE-2024-45385A vulnerability has been identified in Industrial Edge Manag…6.1
• CVE-2024-45386A vulnerability has been identified in SIMATIC PCS neo V4.0 …8.8
• CVE-2024-45387An SQL injection vulnerability in Traffic Ops in Apache Traf…8.8
• CVE-2024-45388Hoverfly is a lightweight service virtualization/ API simula…7.5
• CVE-2024-4539An issue has been discovered in GitLab CE/EE affecting all v…6.5
• CVE-2024-45390@blakeembrey/template is a string template library. Prior to…9.8
• CVE-2024-45391Tina is an open-source content management system (CMS). Site…7.5
• CVE-2024-45392SuiteCRM is an open-source customer relationship management …4.3
• CVE-2024-45393Computer Vision Annotation Tool (CVAT) is an interactive vid…6.4
• CVE-2024-45394Authenticator is a browser extension that generates two-step…7.8