Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CVE-2022-23647 (Medium) detected in prismjs-1.24.1.tgz #137

Open
mend-for-github-com bot opened this issue Feb 25, 2022 · 0 comments
Open

CVE-2022-23647 (Medium) detected in prismjs-1.24.1.tgz #137

mend-for-github-com bot opened this issue Feb 25, 2022 · 0 comments
Labels
security vulnerability Security vulnerability detected by WhiteSource

Comments

@mend-for-github-com
Copy link
Contributor

mend-for-github-com bot commented Feb 25, 2022 •
edited
Loading

CVE-2022-23647 - Medium Severity Vulnerability

Vulnerable Library - prismjs-1.24.1.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.24.1.tgz

Path to dependency file: /barista-docs/package.json

Path to vulnerable library: /barista-docs/node_modules/prismjs/package.json

Dependency Hierarchy:

  • preset-classic-2.0.0-beta.5.tgz (Root Library)
    • theme-classic-2.0.0-beta.5.tgz
      • ❌ prismjs-1.24.1.tgz (Vulnerable Library)

Found in HEAD commit: 2b8e77b2ff0d688bfd2ffb44061287e82fa71967

Found in base branch: master

Vulnerability Details

Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.

Publish Date: 2022-02-18

URL: CVE-2022-23647

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3949-f494-cm99

Release Date: 2022-02-18

Fix Resolution (prismjs): 1.27.0

Direct dependency fix Resolution (@docusaurus/preset-classic): 2.0.0-beta.6

⛑️ Automatic Remediation is available for this issue
@mend-for-github-com mend-for-github-com bot added the security vulnerability Security vulnerability detected by WhiteSource label Feb 25, 2022
@mend-for-github-com mend-for-github-com bot changed the title CVE-2022-23647 (High) detected in prismjs-1.24.1.tgz CVE-2022-23647 (Medium) detected in prismjs-1.24.1.tgz Mar 1, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security vulnerability Security vulnerability detected by WhiteSource
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants