Executive brief
Prism is a popular software library used by websites to display code snippets with clear, readable formatting. A security flaw in its Command Line plugin allows attackers to inject malicious scripts into a webpage if the site displays untrusted code using that specific plugin. This could lead to unauthorized actions being performed in a user's browser or the theft of sensitive session information.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Command Line plugin of PrismJS. The root cause is the failure to properly escape output markup when processing command-line code blocks, allowing input text to be inserted directly into the DOM as HTML. An attacker can exploit this by providing malicious code snippets to a website that uses the affected plugin to render untrusted content. Successful exploitation requires a victim to visit a page where the malicious snippet is rendered. Server-side usage of Prism is unaffected. The issue is fixed in version 1.27.0 by implementing proper encoding of output lines.
Affected products
- PrismJS prismjs >= 1.14.0, < 1.27.0
Timeline
- 2022-02-16: patched: Fix merged into master branch
- 2022-02-18: advisory: GitHub and NVD advisories published
- 2022-02-22: disclosed