DOM Clobbering Vulnerability in PrismJS: A Security Concern
Summary
CVE-2024-53382: PrismJS DOM Clobbering vulnerability. Affects prismjs versions < 1.30.0. Fixed in 1.30.0. How to fix ↓
Also tracked for
- node-prismjs · Debian:11
The same CVE-2024-53382 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PrismJS is a lightweight, extensible syntax highlighter, designed to make code snippets more readable and visually appealing in web applications. It supports a wide range of programming languages and is widely used in documentation and blogs. However, versions up to 1.29.0 are vulnerable to a DOM Clobbering issue that can lead to Cross-Site Scripting (XSS) attacks when untrusted HTML input is processed.
Vulnerability Detail
The vulnerability in PrismJS arises from its handling of the document.currentScript property, which can be shadowed by maliciously injected HTML elements. This allows attackers to manipulate the DOM in a way that can lead to XSS, particularly when untrusted input is involved. The potential ramifications include unauthorized script execution, data theft, and other security breaches, making it critical for developers to address this issue promptly.
How To Fix
Latest published version: 1.30.0 as of 23 Oct 2026
npm install prismjs@1.30.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, consider sanitizing any untrusted HTML input before processing it with PrismJS. This can be done using libraries like DOMPurify to clean the input and prevent potential XSS attacks.
Conclusion
The DOM Clobbering vulnerability in PrismJS poses a significant risk for applications that process untrusted HTML input. It is crucial for developers to update to the latest version of the package and implement input sanitization practices to safeguard against potential attacks.
See every vulnerability recorded for prismjs →
FAQ
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
The consequences include unauthorized script execution, data theft, and potential compromise of user data, leading to significant security risks.
Yes, you can sanitize untrusted HTML input using libraries like DOMPurify to prevent XSS attacks until you can update the package.
DOM Clobbering is a technique where an attacker manipulates the Document Object Model (DOM) to overwrite existing properties or methods, potentially leading to security vulnerabilities like XSS.
References
Related vulnerabilities
Recent vulnerabilities recorded for prismjs.
