Executive brief
PrismJS is a syntax highlighting library used on websites to display code snippets. The Previewers plugin included with PrismJS allows code previews, including CSS easing functions. An XSS vulnerability in this preview feature allows attackers to execute arbitrary JavaScript code in a user's browser when viewing malicious code snippets, potentially leading to session hijacking, credential theft, or unauthorized actions on affected websites.
Technical details
A cross-site scripting (CWE-79) vulnerability exists in the easing preview component of the PrismJS Previewers plugin. The vulnerability allows attackers to execute arbitrary JavaScript code in the browsers of users viewing code snippets containing malicious easing function syntax, specifically in Safari and Internet Explorer. The flaw was introduced in PrismJS v1.1.0 and affects all versions through v1.20.x when the Previewers plugin (v1.10.0+) or standalone Previewer: Easing plugin (v1.1.0–v1.9.0) is in use. The vulnerability requires user interaction (viewing a code block with malicious content) and is specific to Safari and Internet Explorer browsers. A patch is available in PrismJS v1.21.0; users can also disable the easing previewer as a workaround.
Affected products
- PrismJS Prism >=1.1.0, <1.21.0
Timeline
- 2020-08-07: disclosed
- 2020-08-07: patched: Fix available in v1.21.0