Description
Stage.js through 0.8.10 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 0.8.10
References
Could your website be exposed too?
SmartScanner can check your website for Stage.js DOM Clobbering vulnerabilty and gives you actionable findings to investigate.
Start a free scanRelated Issues
- DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS - CVE-2024-47068
- Layui has DOM Clobbering gadgets that leads to Cross-site Scripting - CVE-2024-47075
- DOM clobbering could escalate to Cross-site Scripting (XSS) - @pagefind/default-ui - CVE-2024-45389
- Webpack's AutoPublicPathRuntimeModule has a DOM Clobbering Gadget that leads to XSS - CVE-2024-43788
You might also like:
See something that needs correcting? Let us knowUpdated June 30, 2025