Read the docs
TI-2020-11911 Aliases CVE-2020-15138GHSA-wvhm-4hhf-97x9

Cross-Site Scripting in Prism

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

Why it matters now

EPSS 0.02041 81st percentileScored 2026-11-07
Fix Fixed prism (PrismJS): 1.21.0prismjs (npm): 1.21.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
PrismJSprism1.1.0 to before 1.21.01.21.0Patch availableCNA
—prismjs (npm)1.1.0 to before 1.21.01.21.0Patch availableGHSA-wvhm-4hhf-97x9
  • prism VendorPrismJS Affected 1.1.0 to before 1.21.0 Fixed in 1.21.0 Patch available CNA
  • prismjs (npm) Vendor— Affected 1.1.0 to before 1.21.0 Fixed in 1.21.0 Patch available GHSA-wvhm-4hhf-97x9

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:prismjs:previewers:*:*:*:*:*:prismjs:*:*1.1.0 to before 1.21.0VulnerablePrismJS
cpe:2.3:a:apple:safari:-:*:*:*:*:*:*:*not specified by NVDRunning onApple
cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:prismjs:previewers:*:*:*:*:*:prismjs:*:* Versions 1.1.0 to before 1.21.0 Vulnerable ·PrismJS
  • cpe:2.3:a:apple:safari:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
  • cpe:2.3:a:microsoft:internet_explorer:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA prism (PrismJS) Fixed in 1.21.0
  • Fix · GHSA-wvhm-4hhf-97x9 prismjs (npm) Fixed in 1.21.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • OpenShift Service Mesh 1
  • Red Hat Ceph Storage 3
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15138
  2. 2026-10-03 Alias added: GHSA-wvhm-4hhf-97x9

References

Patch 1

Advisory 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences