CVE-2022-23647: Cross-site Scripting in Prism
A Cross-site scripting attack was found in Prism. The command-line plugin did not properly escape its output. This issue leads to the input text being inserted into the Document Object Model (DOM) as HTML code, which can be exploited by an attacker.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-23647?
CVE-2022-23647 is a Cross-site scripting (XSS) vulnerability found in the Prism syntax highlighting library's command-line plugin.
How severe is CVE-2022-23647?
CVE-2022-23647 has a severity rating of high (CVSS score 6.1).
Which software versions are affected by CVE-2022-23647?
Versions of Prism's command-line plugin from 1.14.0 to 1.27.0 are affected.
How can an attacker exploit CVE-2022-23647?
An attacker can exploit CVE-2022-23647 by injecting malicious code or scripts into input fields that are not properly escaped in the command-line plugin, leading to cross-site scripting attacks.
What is the remediation for CVE-2022-23647?
To fix CVE-2022-23647, it is recommended to update to version 1.27.0 or later of Prism's command-line plugin.