MSC-2024-3875

Date: June 29, 2024

A malicious Polyfill reference has been identified in this package. The issue is located in the file "Xlwings\html\xlwings-alert.html". To address this security concern, we recommend taking one of three actions: upgrade the package version to 0.31.7, where the reference was removed, or either remove the affected file completely or replace the suspicious reference with a trusted alternative. Reliable Polyfill sources include Cloudflare (https://cdnjs.cloudflare.com/polyfill) and Fastly (https://community.fastly.com/t/new-options-for-polyfill-io-users/2540). For more detailed information about the Polyfill supply chain attack and its widespread impact, you can refer to our comprehensive blog post at https://www.mend.io/blog/more-than-100k-sites-impacted-by-polyfill-supply-chain-attack/.

Language: Python