Executive brief
tsup is a popular tool used by developers to package TypeScript code for use in web browsers and applications. A security flaw in how it handles internal script references allows an attacker who can inject basic HTML (like a comment or image tag) into a page to trick the application into loading malicious code from an external source. This could lead to unauthorized data access or full control over the user's session on the affected website.
Technical details
A DOM Clobbering vulnerability exists in tsup's 'cjs_shims.js' component. The 'getImportMetaUrl' function incorrectly trusts 'document.currentScript' without verifying if the object is actually a HTMLScriptElement. An attacker can 'clobber' this property by injecting an HTML element (such as an <img> or <form>) with the name or id attribute set to 'currentScript'. When the bundled code attempts to resolve its base URL via 'import.meta.url', it may instead use a URL provided by the attacker, leading to the execution of remote scripts (XSS). This is similar to previous vulnerabilities found in Webpack and Vite. The issue is fixed in version 8.5.1 by verifying the tagName of the currentScript object.
Affected products
- egoist tsup <= 8.3.4
Timeline
- 2024-10-31: other: Vulnerability reported to vendor via Gist
- 2025-03-03: advisory: GHSA-3mv9-4h5g-vhg3 published
- 2025-03-03: disclosed: CVE-2024-53384 published
- 2025-11-13: patched: Fix confirmed in version 8.5.1