CVE-2024-38526

Deeper analysis

pdoc is a tool that generates API documentation for Python projects. When invoked with the --math flag, affected versions embed references to JavaScript files hosted on the polyfill.io CDN; after the CDN was acquired, it began serving malicious code, creating a supply-chain exposure for any documentation built with that option. The issue is tracked as CVE-2024-38526 and carries a CVSS 3.1 score of 7.2.

An attacker who compromises or controls the polyfill.io domain can deliver arbitrary JavaScript to any user who views HTML documentation generated by an unpatched pdoc run with --math. Because the CDN reference is included at generation time and requires no authentication or user interaction beyond loading the page, the exposure affects both the documentation authors and all downstream viewers across network boundaries.

The project addressed the problem in release 14.5.1 by removing the dependency on polyfill.io. The accompanying GitHub Security Advisory and pull request 703 recommend upgrading immediately and regenerating documentation with the patched version; no further configuration changes are required. The EPSS score has remained elevated near its recorded peak of 0.86.