CVE-2024-0758: JavaScript execution via malicious molfiles (XSS)

April 16, 2021 (updated January 22, 2026)

The viewer plugin implementation of <mol:molecule> renders molfile data directly inside a <script> tag without any escaping. Arbitrary JavaScript code can thus be executed in the client browser via crafted molfiles.

References

github.com/advisories/GHSA-2pwh-52h7-7j84
github.com/ipb-halle/MolecularFaces
github.com/ipb-halle/MolecularFaces/security/advisories/GHSA-2pwh-52h7-7j84
nvd.nist.gov/vuln/detail/CVE-2024-0758
vulncheck.com/advisories/vc-advisory-GHSA-2pwh-52h7-7j84

Code Behaviors & Features

Detect and mitigate CVE-2024-0758 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →