pagefind vulnerabilities

Products

• @pagefind/default-ui 1
• @pagefind/modular-ui 1
• pagefind 1

Latest pagefind CVEs

Newest publication first

1. CVE-2024-45389 Pagefind DOM clobbering could escalate to Cross-site Scripting (XSS)

   Published 2024-09-03

   Medium·CVSS 5.4 EPSS 0.42%

   Pagefind, a fully static search library, initializes its dynamic JavaScript and WebAssembly files relative to the location of the first script the user loads. This information is gathered by looking up the value of document.currentScript.src. Prior to Pagefind version 1.1.1, it i...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.