JavaScript Injection Vulnerability in Stirling-PDF by Stirling Tools

CVE-2024-52286

What is CVE-2024-52286?

The Stirling-PDF application contains a vulnerability that permits an attacker to exploit the Merge functionality by uploading files with names that contain HTML tags. This results in the potential execution of arbitrary JavaScript code in the user’s context. The vulnerability arises due to the lack of sanitization on user-supplied file names, specifically at Line 24 of merge.js, where InnerHTML is directly manipulated. Users can be manipulated into executing this code through social engineering tactics, which may lead to phishing attacks. The developers have remedied the issue in version 0.32.0, and all users are strongly encouraged to update their applications to safeguard against exploitation. Currently, there are no workarounds for this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References