Cross-Site Scripting Vulnerability in Prism's Command Line Plugin
Summary
CVE-2022-23647: Prism is a syntax highlighting library. Affects node-prismjs across 2 version ranges.
< 1.23.0+dfsg-1+deb11u2
< e002e78c343154e1c0ddf9d6a0bb85689e1a5c7c
Fixed in 1.23.0+dfsg-1+deb11u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Prism is a popular syntax highlighting library used in web development to enhance the readability of code snippets. It provides a range of features, including support for multiple languages and themes, making it a go-to tool for developers. However, the command line plugin of Prism has a critical vulnerability that allows attackers to exploit it under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2022-23647, arises from the command line plugin of Prism not properly escaping its output. This oversight allows attackers to inject malicious scripts into the DOM, leading to cross-site scripting (XSS) attacks. The issue affects versions 1.14.0 to 1.26.0 of the plugin, and while server-side usage is not impacted, any website utilizing the command line plugin with untrusted inputs is at risk. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.23.0+dfsg-1+deb11u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-prismjsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the command line plugin on untrusted inputs. Additionally, sanitize all code blocks by removing any HTML code text before processing them with the command line plugin. This can be done by implementing a simple function to strip HTML tags from the input, such as:
function sanitizeInput(input) {
return input.replace(/<[^>]*>/g, '');
}
Conclusion
CVE-2022-23647 represents a significant risk for users of the Prism syntax highlighting library, particularly those utilizing the command line plugin. It is crucial to update to version 1.27.0 or later to mitigate this risk. For those unable to update immediately, implementing workarounds can help reduce exposure to potential attacks.
See every vulnerability recorded for node-prismjs →
FAQ
CVE-2022-23647 is a vulnerability in the Prism syntax highlighting library that allows for cross-site scripting attacks through its command line plugin.
Versions 1.14.0 to 1.26.0 of the Prism command line plugin are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, ensure that you do not use the command line plugin with untrusted inputs and sanitize all code blocks.
The CVSS score for CVE-2022-23647 is 6.1, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-prismjs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
