CVE-2022-23647: Cross-site Scripting in Prism
A Cross-site scripting attack was found in Prism. The command-line plugin did not properly escape its output. This issue leads to the input text being inserted into the Document Object Model (DOM) as HTML code, which can be exploited by an attacker.
Other sources
Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.
Prism.js Prism is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the Command line plugin. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victim's Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
— IBM
The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted.
Reference:
https://github.com/PrismJS/prism/security/advisories/GHSA-3949-f494-cm99 https://github.com/PrismJS/prism/pull/3341 https://github.com/PrismJS/prism/commit/e002e78c343154e1c0ddf9d6a0bb85689e1a5c7c
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-23647?
CVE-2022-23647 is a Cross-site scripting (XSS) vulnerability found in the Prism syntax highlighting library's command-line plugin.
How severe is CVE-2022-23647?
CVE-2022-23647 has a severity rating of high (CVSS score 6.1).
Which software versions are affected by CVE-2022-23647?
Versions of Prism's command-line plugin from 1.14.0 to 1.27.0 are affected.
How can an attacker exploit CVE-2022-23647?
An attacker can exploit CVE-2022-23647 by injecting malicious code or scripts into input fields that are not properly escaped in the command-line plugin, leading to cross-site scripting attacks.
What is the remediation for CVE-2022-23647?
To fix CVE-2022-23647, it is recommended to update to version 1.27.0 or later of Prism's command-line plugin.