Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use the command line plugin.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's     command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line     plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML     code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are     also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin     on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use     the command line plugin. (CVE-2022-23647)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Prism is a syntax highlighting library. Starting with version 1.14.0 and prior to version 1.27.0, Prism's
    command line plugin can be used by attackers to achieve a cross-site scripting attack. The command line
    plugin did not properly escape its output, leading to the input text being inserted into the DOM as HTML
    code. Server-side usage of Prism is not impacted. Websites that do not use the Command Line plugin are
    also not impacted. This bug has been fixed in v1.27.0. As a workaround, do not use the command line plugin
    on untrusted inputs, or sanitize all code blocks (remove all HTML code text) from all code blocks that use
    the command line plugin. (CVE-2022-23647)

ID	Name	Product	Family	Severity
256960	Linux Distros Unpatched Vulnerability : CVE-2022-23647	Nessus	Misc.	medium
409419	SCA: security update for prismjs (GHSA-3949-f494-cm99)	Tenable Cloud Security	SCA Checks	medium
409419	SCA: security update for prismjs (GHSA-3949-f494-cm99)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2022-23647

medium

Tenable Plugins

medium

medium

medium