CVE-2024-53382CWE-94

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript)…

Medium · published March 3, 2025

CVSS v3.1
4.9
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00342 · 26.4th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-03-03T00:00Z
EPSS history
Timeline
  • 03 MAR 00:00Z
    Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript)…
    cvelistv5