From bd571269fb4ceeefbfa04304cd0ab2138f08860a Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 26 Jun 2024 15:07:47 +0000
Subject: [PATCH] Publish GHSA-5vgj-ggm4-fg62

---
 .../GHSA-5vgj-ggm4-fg62.json                    | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/advisories/github-reviewed/2024/06/GHSA-5vgj-ggm4-fg62/GHSA-5vgj-ggm4-fg62.json b/advisories/github-reviewed/2024/06/GHSA-5vgj-ggm4-fg62/GHSA-5vgj-ggm4-fg62.json
index 1e7c0352038..7fb08a34840 100644
--- a/advisories/github-reviewed/2024/06/GHSA-5vgj-ggm4-fg62/GHSA-5vgj-ggm4-fg62.json
+++ b/advisories/github-reviewed/2024/06/GHSA-5vgj-ggm4-fg62/GHSA-5vgj-ggm4-fg62.json
@@ -1,15 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-5vgj-ggm4-fg62",
-  "modified": "2024-06-25T22:26:53Z",
+  "modified": "2024-06-26T15:06:20Z",
   "published": "2024-06-25T22:23:30Z",
   "aliases": [
-
+    "CVE-2024-38526"
   ],
   "summary": "pdoc embeds link to malicious CDN if math mode is enabled",
-  "details": "### Impact\n\nDocumentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.\nThe polyfill.io CDN has been sold and now serves malicious code.\n\nUsers who produce documentation with math mode should update immediately. All other users are unaffected.\n\n### Patches\n\nThis issue has been fixed in pdoc 14.5.1.\n\n### References\n\nhttps://github.com/mitmproxy/pdoc/pull/703\nhttps://sansec.io/research/polyfill-supply-chain-attack\n\n### Timeline\n\n- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published.\n- **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz.\n- **[2024-06-25 21:33 UTC]** Patched version released.\n- **[2024-06-25 21:37 UTC]** Security advisory published.",
+  "details": "### Impact\n\nDocumentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.\nThe polyfill.io CDN has been sold and now serves malicious code.\n\nUsers who produce documentation with math mode should update immediately. All other users are unaffected.\n\n### Patches\n\nThis issue has been fixed in pdoc 14.5.1.\n\n### References\n\nhttps://github.com/mitmproxy/pdoc/pull/703\nhttps://sansec.io/research/polyfill-supply-chain-attack\n\n### Timeline\n\n- **[2024-06-25]** https://sansec.io/research/polyfill-supply-chain-attack is published.\n- **[2024-06-25 20:54 UTC]** Issue reported to the pdoc project by @adhintz.\n- **[2024-06-25 21:33 UTC]** Patched version released.\n- **[2024-06-25 21:37 UTC]** Security advisory published.\n- **[2024-06-25 23:49 UTC]** CVE-2024-38526 assigned by GitHub.",
   "severity": [
-
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L"
+    }
   ],
   "affected": [
     {
@@ -37,6 +40,10 @@
       "type": "WEB",
       "url": "https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62"
     },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38526"
+    },
     {
       "type": "WEB",
       "url": "https://github.com/mitmproxy/pdoc/pull/703"
@@ -61,6 +68,6 @@
     "severity": "HIGH",
     "github_reviewed": true,
     "github_reviewed_at": "2024-06-25T22:23:30Z",
-    "nvd_published_at": null
+    "nvd_published_at": "2024-06-26T00:15:10Z"
   }
 }
\ No newline at end of file