CVE-2024-22048

MediumCVSS 6.1

Published: 04/01/2024(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

Cross-site scripting vulnerability in govuk_tech_docs versions 2.0.2 through before 3.3.1. Malicious JavaScript may be executed in the user's browser when a crafted search result is displayed.

Risk Assessment

An attacker could steal session data, redirect the user to a malicious site, or perform other unauthorized actions within the victim's browser context.

Recommendation

Immediately update the govuk_tech_docs library to version 3.3.1 or later.

Original NVD description (English source)

govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.