PT-2022-16158 · Prism · Prism

At055612 · Published 2022-02-18 · Updated 2022-02-28 · CVE-2022-23647

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Prism versions 1.14.0 through 1.26.x

Description Prism is a syntax highlighting library. The command line plugin can be used by attackers to achieve a cross-site scripting attack due to improper output escaping, leading to input text being inserted into the DOM as HTML code. Server-side usage of Prism and websites not using the Command Line plugin are not impacted.

Recommendations For versions 1.14.0 through 1.26.x, as a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks by removing all HTML code text from code blocks that use the command line plugin. For all affected versions, update to version 1.27.0 to fix the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-23647

GHSA-3949-F494-CM99

Affected Products

Prism

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23647.json · Exploit
• https://github.com/PrismJS/prism/pull/3341 · Patch
• https://github.com/PrismJS/prism/commit/e002e78c343154e1c0ddf9d6a0bb85689e1a5c7c · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23647 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23647 · Security Note
• https://osv.dev/vulnerability/GHSA-3949-f494-cm99 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23647 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23647 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-23647 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23647 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23647 · Vendor Advisory
• https://github.com/PrismJS/prism/security/advisories/GHSA-3949-f494-cm99 · Note
• https://github.com/PrismJS/prism · Note
• https://github.com/PrismJS/prism/issues/3340 · Note
• https://t.me/cibsecurity/37707 · Telegram Post