Code injection in PrismJS Prism
Priority MEDIUM 58CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution, Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 3 fixed, 17 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-94 and CWE-79.
Summary
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00342 27th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial prismjs (npm): 1.30.0Red Hat: 3 advisoriesRed Hat: 3 fixed, 17 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PrismJS | Prism | up to 1.29.0 | — | No fix listed | CNA |
| — | prismjs (npm) | before 1.30.0 | 1.30.0 | Patch available | GHSA-x7hr-w5r2-h6wg |
- Prism VendorPrismJS Affected up to 1.29.0 Fixed in — No fix listed CNA
- prismjs (npm) Vendor— Affected before 1.30.0 Fixed in 1.30.0 Patch available GHSA-x7hr-w5r2-h6wg
Remediation
- Fix · GHSA-x7hr-w5r2-h6wg prismjs (npm) Fixed in 1.30.0 Advisory →
Red Hat 3 advisories
- RHSA-2026:3751 Released 2026-03-04 · Red Hat rating ModerateRed Hat Developer Hub 1.9.0 release.
- Red Hat Developer Hub 1.9 registry.redhat.io/rhdh/rhdh-hub-rhel9
- RHSA-2025:11889 Released 2025-07-28 · Red Hat rating Important7.1 container image is now available in the Red Hat Ecosystem Catalog.
- Red Hat Ceph Storage 7.1 Tools rhceph/grafana-rhel10, rhceph/grafana-rhel9, rhceph/keepalived-rhel9 +4
- RHSA-2025:11749 Released 2025-07-24 · Red Hat rating ImportantUpdated 8.1 container image is now available: security and bug fix update
- Red Hat Ceph Storage 8.1 Tools rhceph/grafana-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Security 4 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7.1 Tools | Fixed | RHSA-2025:11889 |
| Red Hat Ceph Storage 8.1 Tools | Fixed | RHSA-2025:11749 |
| Red Hat Developer Hub 1.9 | Fixed | RHSA-2026:3751 |
Not affected: 2 products
- Red Hat Ceph Storage 8.1 Tools
- Red Hat Developer Hub 1.9
Timeline
- 2026-10-02 Threatist record created from CVE-2024-53382
- 2026-10-03 Alias added: GHSA-x7hr-w5r2-h6wg
References
More PrismJS Prism vulnerabilities
- TI-2021-06039 Regular expression denial of service (ReDoS) in prismjs CVSS 3.1HIGH 7.5
- TI-2022-07699 Cross-site Scripting in Prism CVSS 3.1HIGH 7.5
- TI-2021-12391 Regular Expression Denial of Service (ReDoS) in Prism CVSS 3.1HIGH 7.4
- TI-2021-02732 Inefficient Regular Expression Complexity in prismjs/prism CVSS 3.1MEDIUM 6.5
Sources
- CVE-2024-53382 · CVE Program
- CVE-2024-53382 · NVD
- FIRST EPSS
- GHSA-x7hr-w5r2-h6wg · GitHub Advisory Database · CC BY 4.0
- CVE-2024-53382 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences