prismjs (npm)
Lightweight, robust, elegant syntax highlighting.
Advisories
7
Latest version
1.30.0
Released Mar 10, 2025
License
MIT
OpenSSF Scorecard
5.4 / 10
How to fix
Upgrading to 1.30.0 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install prismjs@1.30.0yarn
yarn add prismjs@1.30.0pnpm
pnpm add prismjs@1.30.0Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-x7hr-w5r2-h6wg PrismJS DOM Clobbering vulnerability |
Medium EPSS 0.34% |
< 1.30.0 | 1.30.0 |
| GHSA-x7hr-w5r2-h6wg PrismJS DOM Clobbering vulnerability |
Medium EPSS 0.34% |
< 1.30.0 | 1.30.0 |
| GHSA-3949-f494-cm99 Cross-site Scripting in Prism |
Medium EPSS 1.43% |
>= 1.14.0, < 1.27.0 | 1.27.0 |
| GHSA-hqhp-5p83-hx96 prismjs Regular Expression Denial of Service vulnerability |
Medium EPSS 1.04% |
< 1.25.0 | 1.25.0 |
| GHSA-gj77-59wh-66hg Regular Expression Denial of Service (ReDoS) in Prism |
Medium EPSS 1.42% |
< 1.24.0 | 1.24.0 |
| GHSA-h4hr-7fg3-h35w Denial of service in prismjs |
High EPSS 3.17% |
< 1.23.0 | 1.23.0 |
| GHSA-wvhm-4hhf-97x9 Cross-Site Scripting in Prism |
High EPSS 2.04% |
>= 1.1.0, < 1.21.0 | 1.21.0 |
Source: git+https://github.com/PrismJS/prism.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor