DOM Clobbering Vulnerability in node-prismjs: XSS Risk from Untrusted Input
Summary
DEBIAN-CVE-2024-53382: Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by atta... Affects node-prismjs versions < 1.30.0+dfsg+~1.26.5-1. Fixed in 1.30.0+dfsg+~1.26.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
node-prismjs is a popular library used for syntax highlighting in web applications. It enables developers to easily add code highlighting features to their websites, enhancing readability and user experience. However, versions up to 1.29.0 are susceptible to a serious security flaw that allows attackers to exploit the library through DOM clobbering techniques.
Vulnerability Detail
The vulnerability in node-prismjs arises from its handling of the document.currentScript property, which can be shadowed by attacker-injected HTML elements. This allows for DOM clobbering, where malicious input containing HTML can lead to Cross-Site Scripting (XSS) attacks. Such attacks can compromise user data and application integrity, especially when untrusted input is processed without proper sanitization.
How To Fix
Minimum fixed version
1.30.0+dfsg+~1.26.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-prismjsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any untrusted input is properly sanitized before being processed by the node-prismjs library. This can be done using libraries such as DOMPurify to clean the input and prevent XSS attacks.
Conclusion
The node-prismjs library has a critical vulnerability that can lead to XSS attacks through DOM clobbering. It is essential to update to the patched version to safeguard your application. Implementing input sanitization can serve as a temporary measure until the update is completed.
See every vulnerability recorded for node-prismjs →
FAQ
DOM clobbering is a technique where an attacker can overwrite existing DOM properties by injecting HTML elements with the same names, potentially leading to security vulnerabilities like XSS.
If your application uses node-prismjs versions up to 1.29.0 and processes untrusted input, it may be vulnerable to XSS attacks, allowing attackers to execute malicious scripts in the context of your application.
If an immediate update is not possible, implement input sanitization to mitigate the risk of XSS attacks while you work on upgrading to a secure version.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-prismjs.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
