CVE-2020-15138

HIGH

PrismJS Previewers 1.1.0-1.20.0 - Cross-Site Scripting in Easing Preview

Title source: llm

Description

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

References (3)

Core 3

Core References

Third Party Advisory x_refsource_confirm

https://github.com/PrismJS/prism/security/advisories/GHSA-wvhm-4hhf-97x9

Vendor Advisory x_refsource_misc

https://prismjs.com/plugins/previewers/#disabling-a-previewer

Patch, Third Party Advisory x_refsource_misc

https://github.com/PrismJS/prism/pull/2506/commits/7bd7de05edf71112a3a77f87901a2409c9c5c20c

Scores

CVSS v3 7.1

EPSS 0.0204

EPSS Percentile 79.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Details

CWE

CWE-79

Status published

Products (2)

npm/prismjs 1.1.0 - 1.21.0npm

prismjs/previewers 1.1.0 - 1.21.0

Published Aug 07, 2020

Tracked Since Feb 18, 2026