PT-2025-9273 · Prism+1 · Prism+1

Jackfromeast · CVE-2024-53382 · Published 2025-03-03 · Updated 2026-06-04

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Prism (aka PrismJS) versions prior to 1.29.0

Description The issue allows DOM Clobbering, which can result in XSS for untrusted input that contains HTML but does not directly contain JavaScript. This occurs because the document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Recommendations For Prism (aka PrismJS) versions prior to 1.29.0, update to version 1.29.0 or later to resolve the issue.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2024-53382

ECHO-974C-0E23-847E

GHSA-X7HR-W5R2-H6WG

Affected Products

Debian

Prism

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53382.json · Exploit
• 🔥 https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660 · Exploit
• https://ubuntu.com/security/CVE-2024-53382 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53382 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2024-53382 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53382 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-53382 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53382 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-53382 · Security Note
• https://osv.dev/vulnerability/GHSA-x7hr-w5r2-h6wg · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-53382 · Vendor Advisory
• https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259 · Note
• https://github.com/PrismJS/prism/pull/3863 · Note
• https://github.com/PrismJS/prism/commit/8e8b9352dac64457194dd9e51096b4772532e53d · Note
• https://github.com/PrismJS/prism · Note