Stage.js DOM Clobbering vulnerabilty
Date: 2025-03
Affected: npm/stage-js
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2024-53386
CWE: CWE-79
CWE-94
CVSS: 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)

Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.


Mitigations:

Architectural layers (MAESTRO):