CVE-2024-53382

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Open
LOW (2.9)

Add a comment

Mark as False Positive
Last calculated at:

Affected component

prismjs

Installed version:
1.27.0
Fixed in:
1.30.0

Quick Fix

Update all Dependencies
Update only prismjs

Management decisions across the organization

Copyright Β© 2025 L3montree GmbH and the DevGuard Contributors. All rights reserved. Version 2ab7b793efd72421aea8c3a994ac60202bf1b3a5