Skip to content

prismjs-1.16.0.tgz: 6 vulnerabilities (highest severity is: 7.5) [alpha] (unreachable) #232

Open
Open
prismjs-1.16.0.tgz: 6 vulnerabilities (highest severity is: 7.5) [alpha] (unreachable)#232
@renovate

Description

@renovate
renovate
bot
opened on Mar 27, 2026
📂 Vulnerable Library - prismjs-1.16.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Path to dependency file: /api/package.json

Findings

Finding Severity 🎯 CVSS Exploit Maturity EPSS Library Type Fixed in Remediation Available Reachability
CVE-2021-23341 🔴 High 7.5 Not Defined 1.8% prismjs-1.16.0.tgz Direct N/A ❌ Unreachable
CVE-2021-3801 🔴 High 7.5 Not Defined < 1% prismjs-1.16.0.tgz Direct prismjs - 1.25.0 ✅ Unreachable
CVE-2022-23647 🔴 High 7.5 Not Defined < 1% prismjs-1.16.0.tgz Direct prismjs- v1.27.0 ✅ Unreachable
CVE-2021-32723 🔴 High 7.4 Not Defined < 1% prismjs-1.16.0.tgz Direct prismjs - 1.24.0 ✅ Unreachable
CVE-2020-15138 🔴 High 7.1 Not Defined < 1% prismjs-1.16.0.tgz Direct v1.21.0 ✅ Unreachable
CVE-2024-53382 🟠 Medium 4.9 Not Defined < 1% prismjs-1.16.0.tgz Direct prismjs - 9000.0.1,prismjs - 1.30.0 ✅ Unreachable

Details

🔴CVE-2021-23341

Vulnerable Library - prismjs-1.16.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.16.0.tgz

Path to dependency file: /api/package.json

Dependency Hierarchy:

  • slate-markdown-0.1.0.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • draft-js-prism-plugin-0.1.1.tgz (Root Library)

    • draft-js-prism-1.0.3.tgz
      • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • slate-markdown-0.1.1.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.

Publish Date: Feb 18, 2021 04:00 PM

URL: CVE-2021-23341

Threat Assessment

Exploit Maturity:Not Defined

EPSS:1.8%

Score: 7.5

Suggested Fix

Type: Upgrade version

Origin:

Release Date:

Fix Resolution :

🔴CVE-2021-3801

Vulnerable Library - prismjs-1.16.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.16.0.tgz

Path to dependency file: /api/package.json

Dependency Hierarchy:

  • slate-markdown-0.1.0.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • draft-js-prism-plugin-0.1.1.tgz (Root Library)

    • draft-js-prism-1.0.3.tgz
      • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • slate-markdown-0.1.1.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

prism is vulnerable to Inefficient Regular Expression Complexity

Publish Date: Sep 15, 2021 12:40 PM

URL: CVE-2021-3801

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 7.5

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3801

Release Date: Sep 15, 2021 12:40 PM

Fix Resolution : prismjs - 1.25.0

🔴CVE-2022-23647

Vulnerable Library - prismjs-1.16.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.16.0.tgz

Path to dependency file: /api/package.json

Dependency Hierarchy:

  • slate-markdown-0.1.0.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • draft-js-prism-plugin-0.1.1.tgz (Root Library)

    • draft-js-prism-1.0.3.tgz
      • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • slate-markdown-0.1.1.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.

Publish Date: Feb 18, 2022 02:50 PM

URL: CVE-2022-23647

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 7.5

Suggested Fix

Type: Upgrade version

Origin: GHSA-3949-f494-cm99

Release Date: Feb 18, 2022 02:50 PM

Fix Resolution : prismjs- v1.27.0

🔴CVE-2021-32723

Vulnerable Library - prismjs-1.16.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.16.0.tgz

Path to dependency file: /api/package.json

Dependency Hierarchy:

  • slate-markdown-0.1.0.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • draft-js-prism-plugin-0.1.1.tgz (Root Library)

    • draft-js-prism-1.0.3.tgz
      • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • slate-markdown-0.1.1.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.

Publish Date: Jun 28, 2021 07:15 PM

URL: CVE-2021-32723

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 7.4

Suggested Fix

Type: Upgrade version

Origin: GHSA-gj77-59wh-66hg

Release Date: Jun 28, 2021 07:15 PM

Fix Resolution : prismjs - 1.24.0

🔴CVE-2020-15138

Vulnerable Library - prismjs-1.16.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.16.0.tgz

Path to dependency file: /api/package.json

Dependency Hierarchy:

  • slate-markdown-0.1.0.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • draft-js-prism-plugin-0.1.1.tgz (Root Library)

    • draft-js-prism-1.0.3.tgz
      • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • slate-markdown-0.1.1.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the Previewers plugin (>=v1.10.0) or the Previewer: Easing plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: Aug 07, 2020 04:30 PM

URL: CVE-2020-15138

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 7.1

Suggested Fix

Type: Upgrade version

Origin: https://github.com/PrismJS/prism/v1.21.0

Release Date: Aug 07, 2020 04:30 PM

Fix Resolution : v1.21.0

🟠CVE-2024-53382

Vulnerable Library - prismjs-1.16.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.16.0.tgz

Path to dependency file: /api/package.json

Dependency Hierarchy:

  • slate-markdown-0.1.0.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • draft-js-prism-plugin-0.1.1.tgz (Root Library)

    • draft-js-prism-1.0.3.tgz
      • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

  • slate-markdown-0.1.1.tgz (Root Library)

    • ❌ prismjs-1.16.0.tgz (Vulnerable Library)

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

Publish Date: Mar 03, 2025 12:00 AM

URL: CVE-2024-53382

Threat Assessment

Exploit Maturity:Not Defined

EPSS:< 1%

Score: 4.9

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-53382

Release Date: Mar 03, 2025 12:00 AM

Fix Resolution : prismjs - 9000.0.1,prismjs - 1.30.0

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions