{"cve":"CVE-2024-55652","nvd":{"published":"2024-12-12T02:15:32.377","modified":"2026-06-17T08:11:20.950","status":"Deferred","description":"PenDoc is a penetration testing reporting application. Prior to commit 1d4219c596f4f518798492e48386a20c6e9a2fe6, an attacker can write a malicious docx template containing expressions that escape the JavaScript sandbox to execute arbitrary code on the system. An attacker who can control the contents of the template document is able to execute arbitrary code on the system. By default, only users with the `admin` role are able to create or update templates. Commit 1d4219c596f4f518798492e48386a20c6e9a2fe6 patches the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N","score":6.5},"cwes":["CWE-1336"],"references":["https://github.com/pwndoc/pwndoc/blob/main/backend/src/lib/report-filters.js#L258-L260","https://github.com/pwndoc/pwndoc/commit/1d4219c596f4f518798492e48386a20c6e9a2fe6","https://github.com/pwndoc/pwndoc/security/advisories/GHSA-jw5r-6927-hwpc","https://github.com/pwndoc/pwndoc/security/advisories/GHSA-jw5r-6927-hwpc"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:57:36.180738747+00:00"},"epss":{"cve":"CVE-2024-55652","score":0.00672,"percentile":0.52103,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}