What is the CVSS score of CVE-2024-53382?

CVE-2024-53382 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Prism are affected by CVE-2024-53382?

CVE-2024-53382 presents moderate security risk, a code injection vulnerability rated CVSS 4.9. Exploitation could allow attackers to execute code or inject malicious input.. A patch is available.

Is there a public PoC exploit available for CVE-2024-53382?

Yes, a public proof-of-concept exploit is available for CVE-2024-53382. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2024-53382?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Prism CVE-2024-53382

MEDIUM

Code Injection (CWE-94)

2025-03-03 cve@mitre.org

XSS RCE Code Injection Red Hat Prism Prismjs

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Red Hat

4.9 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

PoC Detected

Jun 27, 2025 - 13:08 vuln.today

Public exploit code

CVE Published

Mar 03, 2025 - 07:15 nvd

MEDIUM 4.9

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

32,370 npm packages depend on prismjs (4,860 direct, 27,746 indirect)

Ecosystem-wide dependent count for version 1.30.0.

DescriptionCVE.org

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements.

AnalysisAI

Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. Prism (aka PrismJS) through 1.29.0 allows DOM Clobbering (with resultant XSS for untrusted input that contains HTML but does not directly contain JavaScript), because document.currentScript lookup can be shadowed by attacker-injected HTML elements. Affected products include: Prismjs Prism. Version information: through 1.29.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.