CVE-2024-45389

What it actually does

The vulnerability allows an attacker with partial HTML injection capability to manipulate document.currentScript.src lookup, causing Pagefind to resolve and load its JavaScript and WebAssembly dependencies from an attacker-controlled external domain instead of the intended location.

Why it matters to the business

Organizations hosting sites that use Pagefind face increased risk of client-side code execution attacks if an attacker can already inject limited HTML, potentially leading to unauthorized access to user data or site functionality on production websites.

How an attack unfolds

An attacker who can inject benign HTML elements such as img tags with a name attribute on a live site uses this to clobber the script source resolution performed by Pagefind. This causes the library to fetch its dynamic files from a malicious domain, escalating the attacker's privileges to full script execution without directly adding a script tag.

How to fix it

Upgrade Pagefind to version 1.1.1 or later (commit 70012fba86ca51bf1f476c3c64d840a81c60e9cb) to enforce loading only from a valid script element. For Debian packages, update webkit2gtk to version 2.22.0-2 or newer on affected releases.

How to confirm the fix worked

Verify the deployed Pagefind version is 1.1.1 or higher and inspect the initialization code to confirm it validates the script element before resolving the source URL. Test by attempting HTML clobbering on a staging site and confirming dependencies load only from the expected origin.

Typical attack path

1. Identify a page using Pagefind on a target site
2. Inject HTML elements with name attributes that interfere with document.currentScript.src resolution
3. Trigger Pagefind initialization
4. Force loading of Pagefind dependencies from attacker-controlled domain
5. Execute arbitrary JavaScript in the victim's browser context

How to detect it

Examine web server and application logs for unexpected external domains in script requests during Pagefind initialization. Review page source and rendered HTML for suspicious img or other elements with name attributes near search script includes. No known in-the-wild exploitation has been reported.

What your security team should do

• Prioritize upgrade of all Pagefind instances to 1.1.1 or later within standard change windows
• Review sites for any HTML injection vectors that could enable this escalation
• Monitor for unusual external script loads originating from Pagefind initialization
• Apply the fix even on low-EPSS vulnerabilities when the library processes untrusted page content