Is CVE-2022-23647 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-23647 being exploited in the wild.

How severe is CVE-2022-23647?

Low severity, with a CVSS score of 3.1, published 22 February 2022.

Which products and versions are affected?

prismjs (npm) SEMVER:introduced=1.14.0,fixed=1.27.0.

Is there a fix for CVE-2022-23647?

Yes. prismjs (npm): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-23647 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2022-23647?

Check whether you run prismjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-23647: PrismJS Prism cross-site scripting in Command Line plugin

CVE-2022-23647 · Severity: low · CVSS 3.1 · Published 2022-02-22

Prism is a popular software library used by websites to display code snippets with clear, readable formatting. A security flaw in its Command Line plugin allows attackers to inject malicious scripts into a webpage if the site displays untrusted code using that specific plugin. This could lead to unauthorized actions being performed in a user's browser or the theft of sensitive session information.

Technologies: prismjs (npm). Vendors: npm.

Quick answers

Is CVE-2022-23647 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-23647 being exploited in the wild.
How severe is CVE-2022-23647?: Low severity, with a CVSS score of 3.1, published 22 February 2022.
Which products and versions are affected?: prismjs (npm) SEMVER:introduced=1.14.0,fixed=1.27.0.
Is there a fix for CVE-2022-23647?: Yes. prismjs (npm): upgrade to 1.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-23647 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2022-23647?: Check whether you run prismjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

prismjs (npm): upgrade to 1.27.0 or later
```
npm install prismjs@1.27.0
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in the Command Line plugin of PrismJS. The root cause is the failure to properly escape output markup when processing command-line code blocks, allowing input text to be inserted directly into the DOM as HTML. An attacker can exploit this by providing malicious code snippets to a website that uses the affected plugin to render untrusted content. Successful exploitation requires a victim to visit a page where the malicious snippet is rendered. Server-side usage of Prism is unaffected. The issue is fixed in version 1.27.0 by implementing proper encoding of output lines.

Affected products

PrismJS prismjs >= 1.14.0, < 1.27.0

Identifiers

CVE-2022-23647
GHSA-3949-f494-cm99

Timeline

2022-02-16: patched: Fix merged into master branch
2022-02-18: advisory: GitHub and NVD advisories published
2022-02-22: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.