CVE-2024-53382: prismjs prism Code Injection
CVSS: 5.4v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2024-53382DEBIAN-CVE-2024-53382GHSA-x7hr-w5r2-h6wgCGA-47v4-8hg5-3fh8CGA-488p-gvr5-9m38CGA-6wcj-v89m-hrh9CGA-6ww9-wf5p-6mg9CGA-fgjj-7qw6-8843CGA-gxr9-r359-5mc4CGA-j9mc-5r89-4rf4CGA-m9j4-jq3r-j4vvCGA-mccw-xc74-mxr6CGA-mg6c-xv92-r725CGA-mrc4-c8fj-985wCGA-qrrh-3g66-jxv7CGA-r843-j7vx-43hhCGA-vj3r-5ww2-pmcxCGA-x6mx-7935-vrwjCGA-xj5v-6cx7-jh48
Published 03-03-2025Last modified 03-03-2025
Vulnerability summary
CVE-2024-53382 is a medium (CVSS 5.4) Code Injection vulnerability in prismjs prism. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.1% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.4/10
010
Medium · v3.1 (NVD)EPSS score
0.34%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 0 · Related 2Timeline
- 03-03-2025PublishedVulnerability first disclosed.
- 03-03-2025Last modifiedVulnerability information updated.
Description
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 5.4Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NSources6 sources · 4.9–5.4
- CVE.orgCNA4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- OSV · NpmEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NDiffers
- OSV · ChainguardEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
+0.01 pp
From 0.34% on 19-09-2026
19-09-202619-10-2026
EPSS score0.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundAeb128E44F05F95828A1A824708Df660
Maturity: poc
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Affected systems
Chainguard8 products
- kibana-8.19< 8.19.3-r1
- kibana-8.19-bitnami< 8.19.3-r1
- kibana-8.19-iamguarded< 8.19.3-r1
- kibana-9.4< 9.4.2-r1
- kibana-9.4-iamguarded< 9.4.2-r1
Debian1 product
- node-prismjsAll versions (No fix recorded) | < 1.30.0+dfsg+~1.26.5-1
Npm1 product
- prismjs< 1.30.0
Prismjs1 product
- prism≤ 1.29.0
Ubuntu1 product
- node-prismjsAll versions (No fix recorded)
5 vendors · 12 products
References
10 links
- github.com/PrismJS/prismPACKAGE