Executive brief
PrismJS is a popular syntax highlighter library used on many websites to display formatted code. This vulnerability allows an attacker to inject malicious HTML that shadows the document.currentScript property, enabling cross-site scripting (XSS) attacks on pages using PrismJS to display untrusted code content. An attacker could execute arbitrary JavaScript in the context of vulnerable web applications.
Technical details
PrismJS through version 1.29.0 is vulnerable to DOM Clobbering, a technique where attacker-injected HTML elements shadow native browser properties like document.currentScript. The vulnerability exists in the core script initialization logic (prism.js lines 226-259) which relies on document.currentScript without proper validation that it actually refers to a script element. When processing untrusted HTML input containing code blocks, an attacker can inject elements that override this property, leading to XSS execution. The attack requires the attacker's HTML to be processed by PrismJS, but does not require the input to contain direct JavaScript tags. The issue was fixed in version 1.30.0 by adding validation to confirm that currentScript is actually set by a script tag.
Affected products
- PrismJS Prism through 1.29.0
Timeline
- 2025-03-03: disclosed
- 2025-03-08: patched: Fix merged in PR #3863