Vulnerabilities

TI-2024-35787 CVE-2024-53382 · GHSA-x7hr-w5r2-h6wg

Code injection in PrismJS Prism

MEDIUM 58

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by atta…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00342 Published 2025-03-03 Partial fix · 1.30.0 CWE-94

TI-2022-07699 CVE-2022-23647 · GHSA-3949-f494-cm99

Cross-site Scripting in Prism

LOW 36

Prism is a syntax highlighting library.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.01425 Published 2022-02-18 Partial fix · 1.27.0 CWE-79

TI-2021-02732 CVE-2021-3801 · GHSA-hqhp-5p83-hx96

Inefficient Regular Expression Complexity in prismjs/prism

LOW 31

prism is vulnerable to Inefficient Regular Expression Complexity

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01036 Published 2021-09-15 Partial fix · 1.25.0 CWE-1333

TI-2021-12391 CVE-2021-32723 · GHSA-gj77-59wh-66hg

Regular Expression Denial of Service (ReDoS) in Prism

LOW 35

Prism is a syntax highlighting library.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.01421 Published 2021-06-28 Partial fix · 1.24, 1.24.0 CWE-400

TI-2021-06039 CVE-2021-23341 · GHSA-h4hr-7fg3-h35w

Regular expression denial of service (ReDoS) in prismjs

LOW 39

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03167 Published 2021-02-18 Partial fix · 1.23.0 CWE-400

TI-2020-11911 CVE-2020-15138 · GHSA-wvhm-4hhf-97x9

Cross-Site Scripting in Prism

LOW 37

Prism is vulnerable to Cross-Site Scripting.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.02041 Published 2020-08-07 Fixed in 1.21.0 CWE-79