Prismjs is a lightweight syntax-highlighting library widely embedded in web pages, documentation sites, and developer tools, creating a distributed attack surface despite its narrow product footprint. Its vulnerability signal centers on web-layer input-handling weaknesses, particularly cross-site scripting and code-injection flaws that arise from the library's role in parsing and rendering untrusted code snippets, alongside regex complexity issues that can impact page performance. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Prismjs over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2020-15138HIGH Prism is vulnerable to Cross-Site Scripting. The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Inte | Aug 7, 2020 | 7.5 | 25 | NO | NO |
CVE-2021-23341HIGH The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components. | Feb 18, 2021 | 7.5 | 24 | NO | NO |
CVE-2021-3801MEDIUM prism is vulnerable to Inefficient Regular Expression Complexity | Sep 15, 2021 | 6.5 | 22 | NO | NO |
CVE-2021-32723MEDIUM Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user | Jun 28, 2021 | 6.5 | 22 | NO | NO |
CVE-2022-23647MEDIUM Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scrip | Feb 18, 2022 | 6.1 | 21 | NO | NO |
CVE-2024-53382MEDIUM Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.curr | Mar 3, 2025 | 5.4 | 16 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Prismjs.
Media articles that mention a CVE ID that affects a product developed by Prismjs — matched by CVE ID, not by vendor name.