Packages / tsup / Security

LowVulnerabilityGHSA-3mv9-4h5g-vhg3CVE-2024-53384Published 3 Mar 2025

tsup DOM Clobbering vulnerability

Your version

Affected releases · tsup

  • 8.x8.0.0 – 8.3.4Fixed in 8.3.5
  • 7.x and older1.0.0 – 7.3.0No fix, no longer updated

On 8.x, the newest line:

npm install tsup@8.3.5
Every release on a timeline
9.x

  1. Not affected

    9.0.0

    1 release, latest

8.x

  1. Affected

    8.0.0 – 8.3.4

    13 releases

  2. Fixed

    8.3.5 – 8.5.1

    5 releases

7.x

  1. Affected

    7.0.0 – 7.3.0

    4 releases

6.x

  1. Affected

    6.0.0 – 6.7.0

    18 releases

5.x

  1. Affected

    5.0.0 – 5.12.9

    53 releases

4.x

  1. Affected

    4.0.0 – 4.14.0

    53 releases

3.x

  1. Affected

    3.0.0 – 3.12.1

    22 releases

2.x

  1. Affected

    2.0.0 – 2.1.0

    5 releases

1.x

  1. Affected

    1.0.0 – 1.5.1

    31 releases

205 stable releases of tsup, oldest to newest, one row per major.

What happens

A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs_shims.js components