CVE-2024-53382: Code Injection
First published: Mon Mar 03 2025(Updated: )
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PrismJS | <1.29.0 | |
| npm/prismjs | <1.30.0 | 1.30.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660
- https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259
- https://nvd.nist.gov/vuln/detail/CVE-2024-53382
- https://github.com/advisories/GHSA-x7hr-w5r2-h6wg (Advisory)
- https://github.com/PrismJS/prism/pull/3863
- https://github.com/PrismJS/prism/commit/8e8b9352dac64457194dd9e51096b4772532e53d
Frequently Asked Questions
What is the severity of CVE-2024-53382?
CVE-2024-53382 has a high severity rating due to its potential for causing DOM Clobbering and XSS vulnerabilities.
How do I fix CVE-2024-53382?
To fix CVE-2024-53382, update PrismJS to version 1.29.1 or later, which addresses the vulnerability.
What types of attacks are possible with CVE-2024-53382?
CVE-2024-53382 can be exploited to perform attackers' XSS attacks through untrusted input containing injected HTML.
Which versions of PrismJS are affected by CVE-2024-53382?
CVE-2024-53382 affects all versions of PrismJS up to and including 1.29.0.
What is DOM Clobbering in relation to CVE-2024-53382?
DOM Clobbering in CVE-2024-53382 refers to the manipulation of the document structure leading to unintended behavior and potential security risks.
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/severity
- agent/author
- agent/references
- agent/softwarecombine
- agent/source
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- collector/nvd-cve
- collector/github-advisory
- source/GitHub
- alias/GHSA-x7hr-w5r2-h6wg
- alias/CVE-2024-53382
- agent/tags
- collector/github-advisory-latest
- vendor/prism
- canonical/prismjs
- package-manager/npm