{"id":"CVE-2024-53382","aliases":["CLSA-2026-1778719550","CLSA-2026-1778719553","CLSA-2026-1793304056","DEBIAN-CVE-2024-53382","EUVD-2024-53973","GHSA-x7hr-w5r2-h6wg","ROOT-APP-NPM-CVE-2024-53382","UBUNTU-CVE-2024-53382"],"status":"published","title":"PrismJS DOM Clobbering vulnerability","description":"Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00342,"percentile":0.27866,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79","CWE-94"],"published":"2025-03-03T00:00:00Z","modified":"2026-11-02T12:03:09Z","fixes":[{"ecosystem":"npm","package":"prismjs","fixed_in":["1.30.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"prismjs","fixed_in":["1.29.0-tuxcare.1","1.27.0-tuxcare.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"node-prismjs","fixed_in":["1.30.0+dfsg+~1.26.5-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/prismjs","fixed_in":["1.27.0-root.io.2","1.27.0-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"prismjs","fixed_in":["1.27.0-aikido.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.29.0-tuxcare.0"},{"fixed":"1.29.0-tuxcare.1"}]}],"versions":["1.29.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.27.0-tuxcare.0"},{"fixed":"1.27.0-tuxcare.1"}]}],"versions":["1.27.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.17.1-tuxcare.0"},{"fixed":"1.17.1-tuxcare.1"}]}],"versions":["1.17.1"],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"node-prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29.0+dfsg+~1.26.0-1","1.30.0+dfsg+~1.26.5-1","1.30.0+dfsg+~1.26.5-2","1.30.0+dfsg+~1.26.6-1"]},{"source":"osv","ecosystem":"Debian:13","package":"node-prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29.0+dfsg+~1.26.0-1","1.30.0+dfsg+~1.26.5-1","1.30.0+dfsg+~1.26.5-2","1.30.0+dfsg+~1.26.6-1"]},{"source":"osv","ecosystem":"Debian:14","package":"node-prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.30.0+dfsg+~1.26.5-1"}]}],"versions":["1.29.0+dfsg+~1.26.0-1"]},{"source":"osv","ecosystem":"npm","package":"prismjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.30.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-root.io.2"},{"fixed":"1.27.0-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.27.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"node-prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0+dfsg-2","1.11.0+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"node-prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.0+dfsg-1","1.25.0+dfsg-1","1.27.0+dfsg+~1.26.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"node-prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29.0+dfsg+~1.26.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"node-prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.29.0+dfsg+~1.26.0-1","1.30.0+dfsg+~1.26.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"node-prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30.0+dfsg+~1.26.6-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"node-prismjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.30.0+dfsg+~1.26.5-1","1.30.0+dfsg+~1.26.5-2","1.30.0+dfsg+~1.26.6-1"]}],"products":[{"vendor":"prismjs","product":"prism"}],"references":[{"url":"https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660","tags":["exploit","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259","tags":["Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53382","tags":["advisory"]},{"url":"https://github.com/PrismJS/prism/pull/3863","tags":["web"]},{"url":"https://github.com/PrismJS/prism/commit/8e8b9352dac64457194dd9e51096b4772532e53d","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x7hr-w5r2-h6wg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53382.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-53382","tags":["advisory"]},{"url":"https://github.com/PrismJS/prism","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-53382","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-53382","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-53382","description":"Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.","status":"published","published":"2025-03-03T00:00:00Z","modified":"2025-03-03T21:53:33.21Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:34:17.865042Z"}],"euvd":[{"id":"EUVD-2024-53973","description":"Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.","status":"published","published":"2025-03-03T00:00:00Z","modified":"2025-03-03T21:53:33Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:17.551015Z"}],"ghsa":[{"id":"GHSA-x7hr-w5r2-h6wg","title":"PrismJS DOM Clobbering vulnerability","description":"Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.","status":"published","published":"2025-03-03T09:30:34Z","modified":"2025-06-30T12:51:20Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79","CWE-94"],"updated_at":"2026-11-02T14:38:48.783737Z"}],"nvd":[{"id":"CVE-2024-53382","description":"Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.","status":"published","published":"2025-03-03T07:15:33.397Z","modified":"2026-06-17T08:08:51.14Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-94","CWE-79"],"updated_at":"2026-11-02T14:10:45.422466Z"}],"osv":[{"id":"CVE-2024-53382","description":"Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.","status":"published","published":"2025-03-03T00:00:00Z","modified":"2026-10-28T02:31:00.098478568Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:44.451316Z"},{"id":"DEBIAN-CVE-2024-53382","description":"Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.","status":"published","published":"2025-03-03T07:15:33.397Z","modified":"2026-11-02T12:03:09.501347508Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.117337Z"},{"id":"GHSA-x7hr-w5r2-h6wg","title":"PrismJS DOM Clobbering vulnerability","description":"Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.","status":"published","published":"2025-03-03T09:30:34Z","modified":"2026-09-10T03:50:23.418597462Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79","CWE-94"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"ROOT-APP-NPM-CVE-2024-53382","title":"CVE-2024-53382 in @rootio/prismjs - Patched by Root","description":"Root has patched CVE-2024-53382 in the @rootio/prismjs package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-06-04T20:56:59Z","modified":"2026-06-05T01:30:40.954416831Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"UBUNTU-CVE-2024-53382","description":"Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.","status":"published","published":"2025-03-03T07:15:00Z","modified":"2026-10-17T12:57:24.433659595Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:11.182485Z"},{"id":"CLSA-2026-1778719550","title":"TuxCare security update for prismjs (1 CVE)","description":"TuxCare rebuilt prismjs to address 1 CVE. Fixed in 1.29.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:28.910270951Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1778719553","title":"TuxCare security update for prismjs (1 CVE)","description":"TuxCare rebuilt prismjs to address 1 CVE. Fixed in 1.27.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:31Z","modified":"2026-10-15T09:45:30.137657122Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1793304056","title":"TuxCare security update for prismjs (6 CVEs)","description":"TuxCare rebuilt prismjs to address 6 CVEs. Fixed in 1.17.1-tuxcare.1.","status":"published","published":"2026-10-29T21:00:57Z","modified":"2026-10-30T02:15:07.694579967Z","updated_at":"2026-11-02T15:43:55.669514Z"}]}}