What is GHSA-x7hr-w5r2-h6wg?

GHSA-x7hr-w5r2-h6wg is a security advisory published by GitHub Security Advisories with Medium severity. PrismJS DOM Clobbering vulnerability

Which CVE IDs does GHSA-x7hr-w5r2-h6wg cover?

GHSA-x7hr-w5r2-h6wg covers the following CVE IDs: CVE-2024-53382. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x7hr-w5r2-h6wg?

GHSA-x7hr-w5r2-h6wg has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

Which products are affected by GHSA-x7hr-w5r2-h6wg?

GHSA-x7hr-w5r2-h6wg affects 1 product, including: npm/prismjs:\u003c 1.30.0.

GHSA-x7hr-w5r2-h6wgMediumCVSS 4.9

PrismJS DOM Clobbering vulnerability

Vendor

GitHub Security Advisories

Published

March 3, 2025

Last Modified

June 30, 2025

🔗 CVE IDs covered (1)

CVE-2024-53382 →

📋 Description

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

🎯 Affected products1

npm/prismjs:< 1.30.0

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2024-53382
https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660
https://github.com/PrismJS/prism/blob/59e5a3471377057de1f401ba38337aca27b80e03/prism.js#L226-L259
https://github.com/PrismJS/prism/pull/3863
https://github.com/PrismJS/prism/commit/8e8b9352dac64457194dd9e51096b4772532e53d
https://github.com/advisories/GHSA-x7hr-w5r2-h6wg