CVE-2024-53382
prismjs: DOM Clobbering vulnerability within the Prism library's prism-autoloader plugin
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · March 3, 2025
Updated · November 4, 2026
Description
A flaw was found in the prism-autoloader plugin of the Prism library. The prism-autoloader plugin uses document.currentScript as the base URL for dynamically loading other dependencies and, in certain circumstances, can be vulnerable to a DOM Clobbering attack. This issue could lead to Cross-site scripting (XSS) attacks on web pages that embed Prism and allow users to inject scriptless HTML elements, such as an img tag with a controlled name attribute.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 4.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
CWE-94 · Improper Control of Generation of Code