Skip to content

XSS vulnerability in the Command line plugin in prismjs

High
RunDevelopment published GHSA-3949-f494-cm99 Feb 18, 2022

Package

npm prismjs (npm)

Affected versions

>= 1.14.0, < 1.27.0

Patched versions

1.27.0

Description

Impact

Prism's Command line plugin can be used by attackers to achieve an XSS attack. The Command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code.

Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted.

Patches

This bug has been fixed in v1.27.0.

Workarounds

Do not use the Command line plugin on untrusted inputs, or sanitized all code blocks (remove all HTML code text) from all code blocks that use the Command line plugin.

References

Severity

High

CVE ID

CVE-2022-23647

Weaknesses

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Learn more on MITRE.