GHSA-x7hr-w5r2-h6wg

PrismJS DOM Clobbering vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-53382

Packages

Ecosystem	Package	Affected	Fixed in
npm	prismjs	< 1.30.0	1.30.0

Details

As written in the advisory (Markdown source, shown as plain text).

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-53382 advisory
https://github.com/PrismJS/prism/pull/3863 web
https://github.com/PrismJS/prism/commit/8e8b9352dac64457194dd9e51096b4772532e53d web
https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660 web
https://github.com/PrismJS/prism package
https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259 web