# CVE-2020-15138: PrismJS cross-site scripting in easing preview

Source: https://junglewise.ai/threats/cve-2020-15138-prismjs-cross-site-scripting-in-easing-preview  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-08-07. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2020-15138 · Severity: low · CVSS 3.1 · Published 2020-08-07

PrismJS is a syntax highlighting library used on websites to display code snippets. The Previewers plugin included with PrismJS allows code previews, including CSS easing functions. An XSS vulnerability in this preview feature allows attackers to execute arbitrary JavaScript code in a user's browser when viewing malicious code snippets, potentially leading to session hijacking, credential theft, or unauthorized actions on affected websites.

Technologies: [prismjs (npm)](https://junglewise.ai/threats/technologies/prismjs), [PrismJS Prism](https://junglewise.ai/threats/technologies/prism). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [PrismJS](https://junglewise.ai/threats/vendors/prismjs).

## Quick answers

**Is CVE-2020-15138 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-15138 being exploited in the wild.

**How severe is CVE-2020-15138?** Low severity, with a CVSS score of 3.1, published 7 August 2020.

**Which products and versions are affected?** prismjs (npm) SEMVER:introduced=1.1.0,fixed=1.21.0; PrismJS Prism >=1.1.0, <1.21.0.

**Is there a fix for CVE-2020-15138?** Yes. prismjs (npm): upgrade to 1.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-15138 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-15138?** Check whether you run prismjs (npm) or PrismJS Prism at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- prismjs (npm): upgrade to 1.21.0 or later

  ```sh
  npm install prismjs@1.21.0
  ```


## Technical details

A cross-site scripting (CWE-79) vulnerability exists in the easing preview component of the PrismJS Previewers plugin. The vulnerability allows attackers to execute arbitrary JavaScript code in the browsers of users viewing code snippets containing malicious easing function syntax, specifically in Safari and Internet Explorer. The flaw was introduced in PrismJS v1.1.0 and affects all versions through v1.20.x when the Previewers plugin (v1.10.0+) or standalone Previewer: Easing plugin (v1.1.0–v1.9.0) is in use. The vulnerability requires user interaction (viewing a code block with malicious content) and is specific to Safari and Internet Explorer browsers. A patch is available in PrismJS v1.21.0; users can also disable the easing previewer as a workaround.

## Affected products

- PrismJS Prism >=1.1.0, <1.21.0

## Identifiers

- CVE-2020-15138
- GHSA-wvhm-4hhf-97x9

## Timeline

- 2020-08-07: disclosed
- 2020-08-07: patched: Fix available in v1.21.0

## References

- [https://github.com/PrismJS/prism/security/advisories/GHSA-wvhm-4hhf-97x9](https://github.com/PrismJS/prism/security/advisories/GHSA-wvhm-4hhf-97x9)

## Related threats

- [PrismJS DOM Clobbering vulnerability](https://junglewise.ai/threats/cve-2024-53382-prismjs-dom-clobbering-vulnerability)
- [PrismJS Prism cross-site scripting in Command Line plugin](https://junglewise.ai/threats/cve-2022-23647-prismjs-prism-cross-site-scripting-in-command-line-plugin)
- [PrismJS regular expression denial of service](https://junglewise.ai/threats/cve-2021-3801-prismjs-regular-expression-denial-of-service)
- [PrismJS Prism regular expression denial of service](https://junglewise.ai/threats/cve-2021-32723-prismjs-prism-regular-expression-denial-of-service)
- [PrismJS regular expression denial of service](https://junglewise.ai/threats/cve-2021-23341-prismjs-regular-expression-denial-of-service)