CVE-2020-15138
Cross-Site Scripting in Prism
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Cross-Site Scripting in Prism
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
- Record
CVE-2020-15138- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2020-0649
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
- Record
EUVD-2020-0649- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wvhm-4hhf-97x9
Cross-Site Scripting in Prism
Impact
The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer.
This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0).
Patches
This problem is patched in v1.21.0.
Workarounds
To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
References
The vulnerability was introduced by this commit on Sep 29, 2015 and fixed by Masato Kinugawa (#2506).
For more information
If you have any questions or comments about this advisory, please open an issue.
- Record
GHSA-wvhm-4hhf-97x9- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
- Record
CVE-2020-15138- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
- Record
CVE-2020-15138- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-15138
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
- Record
DEBIAN-CVE-2020-15138- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
Show 4 moreShow less
OSVGHSA-wvhm-4hhf-97x9
Cross-Site Scripting in Prism
Impact
The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer.
This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0).
Patches
This problem is patched in v1.21.0.
Workarounds
To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
References
The vulnerability was introduced by this commit on Sep 29, 2015 and fixed by Masato Kinugawa (#2506).
For more information
If you have any questions or comments about this advisory, please open an issue.
- Record
GHSA-wvhm-4hhf-97x9- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-15138
Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
- Record
UBUNTU-CVE-2020-15138- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1793304056 No score
TuxCare security update for prismjs (6 CVEs)
TuxCare rebuilt prismjs to address 6 CVEs. Fixed in 1.17.1-tuxcare.1.
- Record
CLSA-2026-1793304056- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2020-15138 No score
CVE-2020-15138 in prismjs - Patched by Root
Root has patched CVE-2020-15138 in the prismjs package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2020-15138- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prismjsnpm |
1.1.0 up to 1.21.0 | 1.21.0 |
prismjsTuxCare:npm From an advisory covering 6 CVEs |
1.17.1-tuxcare.0 up to 1.17.1-tuxcare.1, plus listed versions 1.17.1 |
1.17.1-tuxcare.1 |
node-prismjsDebian:12 |
before 1.11.0+dfsg-4 | 1.11.0+dfsg-4 |
node-prismjsDebian:13 |
before 1.11.0+dfsg-4 | 1.11.0+dfsg-4 |
node-prismjsDebian:14 |
before 1.11.0+dfsg-4 | 1.11.0+dfsg-4 |
prismjsRoot:npm |
before 1.17.1-aikido.1 | 1.17.1-aikido.1 |
@rootio/prismjsRoot:npm |
before 1.17.1-root.io.1 | 1.17.1-root.io.1 |
node-prismjsUbuntu:20.04:LTS |
All versions, plus listed versions 1.11.0+dfsg-21.11.0+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-15138 is a high vulnerability (CVSS 7.1) in Prismjs Previewers, published August 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in prismjs 1.21.0.
References
github.com/PrismJS/prism/security/advisories/GHSA-wvhm-4hhf-97x9
prismjs.com/plugins/previewers
nvd.nist.gov/vuln/detail/CVE-2020-15138
security-tracker.debian.org/tracker/CVE-2020-15138
ubuntu.com/security/CVE-2020-15138
cve.org/CVERecord?id=CVE-2020-15138