GitHub Advisoryadvisory · npm

GHSA-x7hr-w5r2-h6wg PrismJS DOM Clobbering vulnerability

MEDIUM Published 2025-03-03 Modified 2025-06-30 Official page ↗
Aliases
CVE-2024-53382
Ecosystem
npm
Packages
prismjs
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Weaknesses
CWE-79, CWE-94
Reviewed
2025-03-03

Affected packages

• npm prismjs: < 1.30.0 → fixed in 1.30.0

Description

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Related

Alias · CVE (1)

  • CVE-2024-53382 Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly… vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-94 Improper Control of Generation of Code weakness

References