debian/node-prismjs vulnerabilities

Latest debian/node-prismjs CVEs

Newest publication first

1. CVE-2024-53382 PrismJS DOM Clobbering vulnerability

   Published 2025-03-03

   Medium·CVSS 5.4

   Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

2. CVE-2022-23647 Cross-site Scripting in Prism

   Published 2022-02-18

   Medium·CVSS 6.1 EPSS 1.4%

   Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text b...

3. CVE-2021-3801 Inefficient Regular Expression Complexity in prismjs/prism

   Published 2021-09-15

   Medium·CVSS 6.5 EPSS 1.0%

   prism is vulnerable to Inefficient Regular Expression Complexity

4. CVE-2021-23341 Regular Expression Denial of Service (ReDoS)

   Published 2021-02-18

   High·CVSS 7.5

   The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.

5. CVE-2020-15138 Cross-Site Scripting in Prism

   Published 2020-08-07

   High·CVSS 7.5 EPSS 2.0%

   Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Pr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.