CVE-2024-53382

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660	Exploit Patch Third Party Advisory
https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259	Product
https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660	Exploit Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:prismjs:prism:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2025-03-03 07:15

Updated : 2025-06-27 13:08

NVD link : CVE-2024-53382

Mitre link : CVE-2024-53382

CVE.ORG link : CVE-2024-53382

JSON object : View

Products Affected

prismjs

prism

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2024-53382", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "published": "2025-03-03T07:15:33.397", "references": [{"url": "https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259", "tags": ["Product"], "source": "cve@mitre.org"}, {"url": "https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660", "tags": ["Exploit", "Patch", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements."}, {"lang": "es", "value": "Prism (tambi\u00e9n conocido como PrismJS) hasta la versi\u00f3n 1.29.0 permite el DOM Clobbering (con el consiguiente XSS para entradas no confiables que contienen HTML pero no contienen directamente JavaScript), porque la b\u00fasqueda de document.currentScript puede ser ocultada por elementos HTML inyectados por un atacante."}], "lastModified": "2025-06-27T13:08:24.660", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:prismjs:prism:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "D9B99D59-D970-4A13-9526-394BA7C0E81D", "versionEndIncluding": "1.29.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}