Is CVE-2024-53382 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-53382 being exploited in the wild.

How severe is CVE-2024-53382?

Low severity, with a CVSS score of 3.1, published 3 March 2025.

Which products and versions are affected?

prismjs (npm) SEMVER:introduced=0,fixed=1.30.0; PrismJS Prism through 1.29.0.

Is there a fix for CVE-2024-53382?

Yes. prismjs (npm): upgrade to 1.30.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-53382 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-53382?

Check whether you run prismjs (npm) or PrismJS Prism at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-53382: PrismJS DOM Clobbering vulnerability

CVE-2024-53382 · Severity: low · CVSS 3.1 · Published 2025-03-03

PrismJS is a popular syntax highlighter library used on many websites to display formatted code. This vulnerability allows an attacker to inject malicious HTML that shadows the document.currentScript property, enabling cross-site scripting (XSS) attacks on pages using PrismJS to display untrusted code content. An attacker could execute arbitrary JavaScript in the context of vulnerable web applications.

Technologies: prismjs (npm), PrismJS Prism. Vendors: npm, PrismJS.

Quick answers

Is CVE-2024-53382 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-53382 being exploited in the wild.
How severe is CVE-2024-53382?: Low severity, with a CVSS score of 3.1, published 3 March 2025.
Which products and versions are affected?: prismjs (npm) SEMVER:introduced=0,fixed=1.30.0; PrismJS Prism through 1.29.0.
Is there a fix for CVE-2024-53382?: Yes. prismjs (npm): upgrade to 1.30.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-53382 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-53382?: Check whether you run prismjs (npm) or PrismJS Prism at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

prismjs (npm): upgrade to 1.30.0 or later
```
npm install prismjs@1.30.0
```

Technical details

PrismJS through version 1.29.0 is vulnerable to DOM Clobbering, a technique where attacker-injected HTML elements shadow native browser properties like document.currentScript. The vulnerability exists in the core script initialization logic (prism.js lines 226-259) which relies on document.currentScript without proper validation that it actually refers to a script element. When processing untrusted HTML input containing code blocks, an attacker can inject elements that override this property, leading to XSS execution. The attack requires the attacker's HTML to be processed by PrismJS, but does not require the input to contain direct JavaScript tags. The issue was fixed in version 1.30.0 by adding validation to confirm that currentScript is actually set by a script tag.

Affected products

PrismJS Prism through 1.29.0

Identifiers

CVE-2024-53382
GHSA-x7hr-w5r2-h6wg

Timeline

2025-03-03: disclosed
2025-03-08: patched: Fix merged in PR #3863

References

https://github.com/PrismJS/prism/pull/3863

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.