CVE-2024-53382
MEDIUM4.9EPSS 0.16%PrismJS DOM Clobbering vulnerability
發布日:2025/3/3修改日:2026/4/28
描述
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
受影響套件(2)
- Debian/node-prismjsfrom 0
- npm/prismjsfrom 0, < 1.30.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N |
參考連結(7)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-53382
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2024-53382
- PATCHhttps://github.com/PrismJS/prism
- WEBhttps://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660
- WEBhttps://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259
- WEBhttps://github.com/PrismJS/prism/commit/8e8b9352dac64457194dd9e51096b4772532e53d
- WEBhttps://github.com/PrismJS/prism/pull/3863