CVE-2020-15138CWE-79

Cross-Site Scripting in Prism

High · published August 7, 2020

CVSS v3.1
7.1
EPSS
2%
Percentile
81.0
In the wild
Unconfirmed
What it is

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.02041 · 81.0th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2020-08-07T16:30Z
EPSS history
Timeline
  • 07 AUG 16:30Z
    Cross-Site Scripting in Prism
    cvelistv5