CVE-2024-53382 PrismJS DOM Clobbering vulnerability
Attacker can execute arbitrary JavaScript via DOM Clobbering in PrismJS when processing untrusted HTML input.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53382?
CVE-2024-53382 is a medium-severity cross-site scripting vulnerability in PrismJS Prism, published on 3 Mar 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.
Which versions are affected by CVE-2024-53382?
2 open source packages ship an affected version, including prismjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
prismjs npm | All versions | 1.30.0 |
prismjs npm | All versions | 1.30.0 |
Products include Prismjs Prism.
How do I fix CVE-2024-53382?
Upgrade prismjs to 1.30.0 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-53382 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53382 exists.
Other vulnerabilities in PrismJS Prism
Sources
Also known as CLEANSTART-2026-CB71231, CLEANSTART-2026-VC34958, CLSA-2026-1778719550, CLSA-2026-1778719553, DEBIAN-CVE-2024-53382, ECHO-974c-0e23-847e and 14 more.