CVE-2020-15138

published 2020-08-07

CVE-2020-15138: Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary…

Priority P3 37 high 7.5 CVSS 3.1

AV N AC H PR N UI R S C C H I L A L

Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer. This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0). This problem is fixed in version 1.21.0. To workaround the issue without upgrading, disable the easing preview on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	node-prismjs	< node-prismjs 1.11.0+dfsg-4 (bookworm)	node-prismjs 1.11.0+dfsg-4 (bookworm)
prismjs	previewers	>= 1.1.0 < 1.21.0	1.21.0
prismjs	prism	—	—

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L

nvd v2.0 2.6 LOW AV:N/AC:H/Au:N/C:N/I:P/A:N

osv 7.5 HIGH

vendor_debian 7.1 HIGH

vendor_redhat 7.1 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79