High severity · published Aug 7, 2020
CVE-2020-15138
Prism is vulnerable to Cross-Site Scripting
7.5
CVSS
2%
EPSS
No
On KEV
Description
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Previewers · Prismjs
1.1.0 before 1.21.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15138
Patch
https://github.com/PrismJS/prism/pull/2506/commits/7bd7de05edf71112a3a77f87901a2409c9c5c20c
Third Party Advisory
https://github.com/PrismJS/prism/security/advisories/GHSA-wvhm-4hhf-97x9
Vendor Advisory
https://prismjs.com/plugins/previewers/#disabling-a-previewer