Medium severity · published Feb 18, 2022
CVE-2022-23647
Prism is a syntax highlighting library
6.1
CVSS
1.4%
EPSS
No
On KEV
Description
Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Prism · Prismjs
1.14.0 before 1.27.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-23647
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-23647
Patch
https://github.com/PrismJS/prism/commit/e002e78c343154e1c0ddf9d6a0bb85689e1a5c7c
Patch
https://github.com/PrismJS/prism/pull/3341
Third Party Advisory
https://github.com/PrismJS/prism/security/advisories/GHSA-3949-f494-cm99
More from Prism
7.5
CVE-2021-23341
The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components
6.5
CVE-2021-3801
prism is vulnerable to Inefficient Regular Expression Complexity
6.5
CVE-2021-32723
Prism is a syntax highlighting library
5.4
CVE-2024-53382
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because…