CVE-2022-23647 (High) detected in prismjs-1.25.0.tgz #123

CVE-2022-23647 - High Severity Vulnerability

<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png&#39; width=19 height=20> Vulnerable Library - <b>prismjs-1.25.0.tgz</b></p></summary>

<p>Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.</p> <p>Library home page: <a href="https://registry.npmjs.org/prismjs/-/prismjs-1.25.0.tgz">https://registry.npmjs.org/prismjs/-/prismjs-1.25.0.tgz</a></p> <p>Path to dependency file: /package.json</p> <p>Path to vulnerable library: /node_modules/prismjs/package.json</p> <p>

Dependency Hierarchy:

• vuepress-1.9.7.tgz (Root Library)
  • core-1.9.7.tgz
    • markdown-1.9.7.tgz
      • :x: prismjs-1.25.0.tgz (Vulnerable Library)

        <p>Found in base branch: <b>master</b></p> </p> </details> <p></p> <details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png&#39; width=19 height=20> Vulnerability Details</summary> <p>

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.

<p>Publish Date: 2022-02-18 <p>URL: <a href=https://vuln.whitesourcesoftware.com/vulnerability/CVE-2022-23647>CVE-2022-23647</a></p> </p> </details> <p></p> <details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png&#39; width=19 height=20> CVSS 3 Score Details (<b>7.5</b>)</summary> <p>

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: Low

    </p> For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>. </p> </details> <p></p> <details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/suggested_fix.png&#39; width=19 height=20> Suggested Fix</summary> <p>

<p>Type: Upgrade version</p> <p>Origin: <a href="https://github.com/PrismJS/prism/security/advisories/GHSA-3949-f494-cm99">https://github.com/PrismJS/prism/security/advisories/GHSA-3949-f494-cm99</a></p> <p>Release Date: 2022-02-18</p> <p>Fix Resolution: prismjs- v1.27.0</p>

</p> </details> <p></p>

Step up your Open Source Security Game with WhiteSource here