CVE-2024-38526 — AI Deep Analysis Summary

Q: What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: pdoc < 14.5.1 uses a compromised CDN (`polyfill.io`) for math documentation. ⚠️ **Consequences**: Malicious code injection via third-party dependency. Risk of XSS or supply chain attack.

Q: Root Cause? (CWE/Flaw)

🛡️ **CWE-1395**: Use of Third-Party Components Containing a Known Vulnerable Component. ❌ **Flaw**: Hardcoded link to an insecure CDN in `pdoc --math` command output.

Q: Who is affected? (Versions/Components)

👥 **Affected**: `mitmproxy/pdoc` versions **before 14.5.1**. 📦 **Component**: Python API documentation generator using math rendering.

Q: What can hackers do? (Privileges/Data)

💻 **Hackers Can**: Inject malicious JavaScript into generated docs. 🔓 **Impact**: Execute arbitrary code in user's browser (XSS), steal session data, or redirect traffic.

Q: Is exploitation threshold high? (Auth/Config)

🔑 **Threshold**: Low. 🌐 **Auth**: None required (PR:N). 🖱️ **UI**: User interaction needed to view generated docs, but the vector is Network (AV:N).

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔍 **Public Exp**: Yes. 📂 **Tools**: `pollypull`, `pollyscan`, and Nuclei templates available. 🌍 **Status**: Scanner tools exist to detect affected URLs.

Q: How to self-check? (Features/Scanning)

🔎 **Self-Check**: Scan for scripts loading from `polyfill.io` in generated HTML. 🛠️ **Tools**: Use `pollyscan` or Nuclei `CVE-2024-38526.yaml` template to automate detection.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. 📦 **Patch**: Upgrade to **pdoc 14.5.1** or later. 🔗 **Ref**: GitHub PR #703 and Security Advisory GHSA-5vgj-ggm4-fg62.

Q: What if no patch? (Workaround)

🚧 **Workaround**: Disable `--math` flag if possible. 🚫 **Block**: Block `polyfill.io` domain at firewall/proxy level. 🔄 **Audit**: Review generated docs for external script tags.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: High. ⚡ **Priority**: Immediate patching recommended. 📉 **Risk**: Supply chain attacks are critical; do not ignore third-party CDN risks.

Updated May 08, 2026

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: pdoc < 14.5.1 uses a compromised CDN (`polyfill.io`) for math documentation. <br>⚠️ **Consequences**: Malicious code injection via third-party dependency. Risk of XSS or supply chain attack.

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE-1395**: Use of Third-Party Components Containing a Known Vulnerable Component. <br>❌ **Flaw**: Hardcoded link to an insecure CDN in `pdoc --math` command output.

Q3Who is affected? (Versions/Components)

👥 **Affected**: `mitmproxy/pdoc` versions **before 14.5.1**. <br>📦 **Component**: Python API documentation generator using math rendering.

Q4What can hackers do? (Privileges/Data)

💻 **Hackers Can**: Inject malicious JavaScript into generated docs. <br>🔓 **Impact**: Execute arbitrary code in user's browser (XSS), steal session data, or redirect traffic.

Q5Is exploitation threshold high? (Auth/Config)

🔑 **Threshold**: Low. <br>🌐 **Auth**: None required (PR:N). <br>🖱️ **UI**: User interaction needed to view generated docs, but the vector is Network (AV:N).

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔍 **Public Exp**: Yes. <br>📂 **Tools**: `pollypull`, `pollyscan`, and Nuclei templates available. <br>🌍 **Status**: Scanner tools exist to detect affected URLs.

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check**: Scan for scripts loading from `polyfill.io` in generated HTML. <br>🛠️ **Tools**: Use `pollyscan` or Nuclei `CVE-2024-38526.yaml` template to automate detection.

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: Yes. <br>📦 **Patch**: Upgrade to **pdoc 14.5.1** or later. <br>🔗 **Ref**: GitHub PR #703 and Security Advisory GHSA-5vgj-ggm4-fg62.

Q9What if no patch? (Workaround)

🚧 **Workaround**: Disable `--math` flag if possible. <br>🚫 **Block**: Block `polyfill.io` domain at firewall/proxy level. <br>🔄 **Audit**: Review generated docs for external script tags.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: High. <br>⚡ **Priority**: Immediate patching recommended. <br>📉 **Risk**: Supply chain attacks are critical; do not ignore third-party CDN risks.

Continue exploring

Vulnerability detail Full AI analysis (login) mitmproxy CWE-1395