Medium severity · published Mar 3, 2025
CVE-2024-53382
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because…
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Prism · Prismjs
through 1.29.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-53382
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-53382
Exploit
https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660
Product
https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259
More from Prism
7.5
CVE-2021-23341
The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components
6.5
CVE-2021-3801
prism is vulnerable to Inefficient Regular Expression Complexity
6.5
CVE-2021-32723
Prism is a syntax highlighting library
6.1
CVE-2022-23647
Prism is a syntax highlighting library